International Data Privacy Statement

I. General

1. Preamble

2. Personal Data and Data Subjects (What does Fronius consider personal data?)

3. Storage Process, Storage Period, and Erasure (How is my data protected?)

4. Rights of Data Subjects (What can I do about my data in Fronius’ possession?)

5. Purpose or Use of Information (Why is my Data collected?)

6. Categories of Data Subjects and Data Collection (What is collected from me?)

7. Sharing of Data (Why is my data shared?)

II. Specialized Information

III. Contact Information

I. General

1. Preamble

1.1 We are Fronius International GmbH, Froniusstraße 1, 4643 Pettenbach, Austria, a technical leader in the fields of welding technology, photovoltaics and battery charging technology and a Controller and Processor of Data. Unless otherwise herein stated “Fronius” shall mean Fronius International GmbH and our Fronius global subsidiaries. A list of the Fronius global subsidiaries outside of the European Economic Area (EEA), can be found here (https://www.fronius.com/en/about-fronius/locations/). This Data Privacy Statement applies to any form of processing of Personal Data by Fronius for Data Subjects outside of the EEA, including processing by third parties.

1.2 With the following International Data Privacy Statement, Fronius would like to inform you, the Data Subject, about the data Fronius processes, your rights as a Data Subject, for what purpose the data is used, why the data is shared, and other specialized information that might be relevant to you.

1.3 All data is processed by us in compliance with the relevant legal regulations on data protection and data security of the European Union (link to GDPR data statement) and when applicable the Data Subject’s nation state. For Data Subjects accessing a Fronius platform outside of the EEA, please refer this International Data Privacy Statement and to Schedule 1 for Jurisdiction Specific Terms. The Schedule 1 terms prevail with regards to jurisdiction specific compliance, as well as personal and procedural jurisdiction requirements, as it relates the Data Subject and Fronius use of Personal Data.

1.4 You can view, download or print our current International Data Privacy Statement any time at https://www.fronius.com. The Data Privacy Statement also represents an integral part of our Terms and Conditions of Use, Solar.Web Terms and Conditions, Web.Shop Terms and Conditions, and all other applications or platforms which Fronius uses all of which are available at https://www.fronius.com, herein Fronius Terms and Conditions.

2. Personal Data and Data Subjects (What does Fronius consider personal data?)

2.1 Personal Data is generally defined as any information that relates to an identified or identifiable living person, or individual. Examples of Personal Data include but are not limited to: contact information, such as the name of the Data Subject, e-mail address, phone number, address; personal information, such as, data of birth, social security number; account information, such as, information regarding creditworthiness, system data, service data; information of the data subject in connection with the fulfilment of the contractual relationship such as, documents and correspondence between a company, third parties and the data subject, delivery, sales and billing data.

2.2 All Personal Data is processed by Fronius exclusively for Fronius and its global subsidiaries. Personal Data is held as strictly confidential. Fronius only transfers or discloses Personal Data to third parties based on one or more of the reasons specified in Section 7. and only if the third party agrees to apply the same or greater level of data protection as Fronius has implemented. We may also process Personal Data of a Data Subject where express consent has been given by the Data Subject. Fronius executes written agreements with all third party processors of Personal Data to ensure our standards of protection are met.

2.3 Insofar as data is not provided directly by a Data Subject, Personal Data may be collected either in publicly accessible databases (e.g. land register, commercial register, central association register, edict database, central register of residents, creditworthiness databases), via search engines, social networks or various websites, at Fronius group companies or with cooperation partners or any funding agencies.

2.4 Fronius servers are located in the European Economic Area (EEA), which is governed by the General Data Protection Regulations (GDPR). Data Subjects outside of the EEA, should note their Persona Data will transfer from their country of origin to our Fronius servers in the EEA. In such cases, Fronius applies the standards of the GDPR, along with your country of origin’s legal standards when it is so required. Please see Schedule 5, Jurisdiction Specific Terms. Fronius only processes Persona Data for the reasons specified in Section III. and only transfers or discloses Personal Data to third parties based on one or more of the purposes specified in Section 7.

3. Storage Process, Storage Period, and Erasure (How is my data protected?)

3.1 Fronius stores personal data for as long as a purpose for the processing, as defined in Section 5, exists. For example data may be stored for the performance of a contract with the Data Subject; the fulfilment of a statutory or legal obligation; as long as is necessary for the establishment, exercise or defense of legal claims; or an overriding legitimate interest of Fronius in the processing exists.

3.2 In order to guarantee the security of the Personal Data of the Data Subjects, Fronius has implemented a number of technical and organizational measures, in particular encryption of the services using state-of-the-art encryption methods (e.g. SSL), user authentication controls, secured network infrastructures, internal restriction of access to Personal Data, network monitoring solutions, internal audits, employee trainings, area-restricted alarm systems, as well as video surveillance, employee administrative instructions, obligation to data secrecy.

3.3 In particular, when Fronius must comply with specific statutory retention obligations or limitation periods, such laws usually relate to:

a) Accounting, tax, and customs law

b) Contract administration

4. Rights of Data Subjects (What can I do about my data in Fronius’ possession?)

4.1 The Data Subject has the right to:

a) Know the purpose for the data collection access to personal Data processed by Fronius,

b) Rectifiy of the personal data in the case of incorrectness or incompleteness,

c) Restrict the processing of the personal data, where certain conditions are fulfilled, particularly in case of considerable suspicion of unlawful processing or contradiction data portability of the personal data in a common, structured and machine-readable format,

d) Erasure of the personal data in the case of any existing legal reasons,

e) Objection with regard to the processing of the personal data pertaining to you, unless Fronius provides compelling and legitimate reasons for data processing or retention,

f) Revocation in case of consent of the data subject to the processing of the personal data; and

g) Lodge a complaint to Fronius, if you believe that Fronius is unlawfully processing your Personal Data.

4.2 Data Subjects may contact Fronius in one of three ways. Data Subjects may:

a) Submit a e-form inquiring found at [insert link to form]

b) Call the toll-free number provided by your national Fronius office found here: (https://www.fronius.com/en/about-fronius/locations/)

c) Mail a letter to the Fronius International GmbH global headquarters or national office of your choosing. Letters should include your contact information and suspected contact with Fronius services which are governed by data privacy laws. [insert link to form]

4.3 Processing a Request: The processing of your request and our response time will be dictated by your country of residency, or the jurisdiction from which the request came. Furthermore your request does not affect the legitimacy of the processing already being carried out until we have received your request and verified its authenticity. The processing of your request or your data must be reasonably verified by Fronius before a transfer of data will occur. Verification instruction will be provided upon request by the Data Subject and are based on the governing jurisdiction of the Data Subject.

5. Purpose or Use of Information (Why is my Data collected?)

5.1 Fronius’ legal bases and purpose for processing data includes the following reasons:

a) It is necessary for the fulfilment of a contract:

Fronius processes Personal Data of a Data Subject: when requested; when in a business context with the Data Subject; when requested by a company which represents the Data Subject; when based on a contract relationship; or when in pre-contractual relationships. Contract data may comprises the name of the Data Subject, Data Subject’s contact information (such as e-mail address, phone number, address), account data, possibly information regarding creditworthiness, if necessary social security data, information of the data subject in connection with the fulfilment of the contractual relationship, in the form of system data, service data, documentation, documents and correspondence between Fronius, the contract partner, if need be the contractor and the data subject, delivery, sales and billing data.

b) For the fulfilment of a statutory or legal obligation;

The processing of Persona Data is carried out to the extent necessary to fulfil a statutory or legal obligation to which Fronius is subjected (e.g. retention and documentation obligations according to the Austrian Commercial Code (UGB), Internal Revenue Service obligations and others, reporting obligations as an employer toward social insurance) or the processing is necessary for the performance of a task carried out in the public interest. For example, business-related correspondence and all relevant tax documents relating to the contractual relationship with the Data Subject or the company represented by the Data Subject.

c) For the protection of the legitimate interests of Fronius or a third party;

The processing of Personal Data is also carried out for the necessary and proportionate protection of legitimate interests of Fronius such as for the protection of business interests. Examples include internal administration and optimization of the business process, enforcement of rights, exercise or defence of legal claims, , prevention of physical damage or financial losses, for the implementation of direct advertising (marketing and information measures, in particular on products and services offered by the controller), for IT security and technical administration as well as for the purposes of file, customer and supplier administration, and, if there is no reason to believe the Data Subject has an overriding or legitimate interest in preventing the disclosure of the data. The processing of data in this category includes all data processed within the context of the relationship between Fronius and the Data Subject, when it is necessary to execute the purpose of the relationship. The legitimate interest of Fronius or the Fronius Group and of recipients of communications also includes the ability to operate a group-wide customer and supplier management system for the purpose of administrative optimization and simplification.

d) Because the data subject has given his consent to the processing.

The processing of Personal Data occurs on the basis of a Data Subject's consent for processing that can be cancelled at any time. For example, the Personal Data of Data Subjects is processed, for which the Data Subject has given prior consent, such as the publication of photographs of the data subject for documentation or advertising purposes.

5.2 Depending on your user experience, we may collect different categories of Personal Data of the Data Subject. The purpose of collection of the data is limited to the categories listed here.

a) Rendering or improving our products and services

b) Creating and managing your account

c) Administering the website and apps

d) Improving the use and content of our platforms (web and apps)

e) Safety and security

f) Marketing

g) Online advertising

h) Personalizing and tailoring your experience

i) Providing a consistent experience across devices and platforms

j) Providing customer service and managing any complaints or requests

k) To make necessary disclosures and law enforcement

l) Administering a sale, transfer or reorganization.

For information regarding Fronius’ reasons for sharing data we collect with third parties, please see section 7 for more details.

6. Categories of Data Subjects and Data Collection (What is collected from me?)

6.1 Connection Data: Our websites and apps, which can be visited at any time track the following information known as “Connection Data:”

a) Browser type and version

b) Operating system

c) Referrer URL (the specific visited website)

d) Host name of the accessing computer (IP address)

e) Time and date of the server request

f) Device (as in mobile or desktop)

6.1.2 Purpose of Connection Data: Connection Data is evaluated and used in an anonymous form by Fronius or in an anonymous form by a third party for the proper functioning of our website, for the provision of its contents, for the detection and tracking of misuse as well as for the improvement of our offer (e.g. by means of scientific research, data analysis, etc.) and any other purpose which is listed in section 5. Connection Data may be shared for valuable consideration with third parties and for any of the reasons listed in section 7.

6.2 System Data: Fronius collects clustered PV system and Fronius product data of Data Subjects who are registered or activated on a Fronius platform, such as Solar.Web. System Data refers to non-personal anonymized data from a PV system or product arising from the use of Fronius websites, Fronius apps, and Fronius services by registered or activated users. An identification of Data Subjects based on System Data is only possible through the process of elimination.

6.2.1 Purpose of System Data: System Data is evaluated and used in an anonymous form by Fronius or in an anonymous form by a third party for analysis of product effectiveness, efficiencies, statistical research or any of the purposes listed in section 5. When System Data is shared with third parties for valuable consideration, it is shared as a large data cluster or data package, so as to prevent the disclosure of Personal Information of a Data Subject through System Data. System Data may also be shared for any of the reasons listed in section 7.

6.3 Registered User Data: Registered User Data includes any data necessary for establishing an account on a Fronius platform. This data may include, but is not limited to: title, first name, last name, company, street, house number, postal code, city, state, country, time zone, phone number, fax number, e-mail address, date of birth, customer number, user name, password.

6.3.1. Purpose of Registered User Data: Registered User Data is necessary to establish a personalized account of the Data Subject, the Data Subject’s PV system, Fronius products, or any purpose listed in section 5. Registered User Data is never shared with third parties for valuable consideration without the express written consent of the Data Subject. Registered User Data may be shared with third parties for any of the reasons listed in section 7.

6.4 Site Data: Site Data includes any data necessary for the proper tracking, monitoring, and maintenance of Fronius products on a Data Subject’s Site. This data may include, but is not limited to: site or system name, system identifier, commissioning date/time, company, street, house number, postal code, city, state, country, time zone, longitude, latitude, height, system performance, manufacturer, module type, system description, system image.

6.4.1 Purpose of Site Data: Site Data is necessary for the effective monitoring and servicing of Fronius products or for any of the reasons listed in section 5. Site data is never shared with third parties for valuable consideration without the express written consent of the Data Subject. Site Data may be shared with third parties for any of the reasons listed in section 7.

6.5 Operator Data: Operator Data includes any data necessary for the facilitation of support services by a third party on behalf of Data Subject or the PV system. This data may include, but is not limited to: Title, first name, last name, company, street, house number, postal code, city, state, country, time zone, phone number, fax number, e-mail address, customer number, sales tax identification number.

6.5.1 Purpose of Operator Data: Operator Data is necessary for servicing the PV systems of Data Subjects and for any of the purposes listed in section 5. Operator Data is never shared with third parties for valuable consideration without the express written consent of the Data Subject. Operator Data may be shared with third parties for any of the reasons listed in section 7.

7. Sharing of Data (Why is my data shared?)

7.1 Fronius shares Personal Data with third parties for any or all of the following reasons:

a) Rendering Services: when we use a service provider to facilitate or offer our services;

b) Compliance: to ensure compliance with, and enforce, our Fronius Terms and Conditions.

c) Legal Obligation: when required by a court order or any legal or regulatory requirement;

d) Protection of Fronius Rights: to protect our rights and property and the rights and property of others

e) Consent: when explicitly requested by you (e.g., with social media networks); and

f) Safety and Security: to ensure the safety and security of our users, consumers and others

7.2 Fronius does not process Personal Data for automatic decision-making or profiling purposes.

II. Specialized Categories of Data

8. Use of cookies

8.1 A cookies is a small text file created by a website that is stored in the user's computer either temporarily for that session only or permanently on the hard disk (persistent cookie). Cookies provide a way for the website to recognize you and keep track of your preferences. Our cookie policy and a regularly updated list of cookies used can be found at: https://www.fronius.com/en/cookie-policy.

9 Google Analytics: Data protection and opt-out option

9.1 The Fronius website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and which help analyse your use of the website. The information generated by the cookie about your use of t website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is enabled on t website, your IP address will first be truncated by Google within the member states of the European Union or other states party to the agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the operator of t website, Google will use t information to evaluate your use of the website in order to compile reports about the website activity for us as website operators and to provide other services associated with the use of the website. The IP address that your browser transmits within the scope of Google Analytics will not be associated with any other data held by Google.

9.2 You can refuse the storing of cookies by selecting the appropriate settings on your browser software; however, we must point out that in t case you may not be able to use all the features of t website. You can also prevent the data generated by cookies concerning your use of the website (including your IP address) from being passed on to Google as well as the processing of these data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en

9.3 You can find more information on Terms of Use and data protection at

http://www.google.com/analytics/terms/de.html or at

http://www.google.com/intl/de/analytics/privacyoverview.html.

9.4 The Google tracking codes of t website use the extension "_anonymizeIP()" so that IP addresses are only processed in abbreviated form in order to prevent direct personal references.

10 Google Analytics Remarketing

10.1 The Fronius websites use the features of Google Analytics Remarketing combined with the cross-device capabilities of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This function enables the advertising target groups created with Google Analytics Remarketing to be linked with the cross-device functions of Google AdWords and Google DoubleClick. T allows advertising messages to be displayed based on your personal interests, identified from your previous usage and surfing behaviour on one device (e.g. your mobile phone), on other devices (such as a tablet or computer).

10.2 Once you have given your consent, Google will associate your web and app browsing tory with your Google Account for t purpose. That way, any device that signs in to your Google Account can use the same personalized advertising messages.

10.3 To support this feature, Google Analytics collects Google-authenticated IDs of users, which are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising. You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account; follow the link:

https://www.google.com/settings/ads/onweb/

10.4 The summary of the data collected in your Google Account is based solely on your consent, which you can submit or revoke to Google. For data collection operations that are not merged into your Google Account (for example, because you do not have a Google Account or have opposed the merge), the collection of data is based on governing laws of your country of domicile. The legitimate interest arises from the fact that the website operator has an interest in anonymous analysis of website visitors for advertising purposes. Further information and the privacy policies can be found in Google's Data Privacy Statement at: https://www.google.com/policies/technologies/ads/

11. Hotjar: Data protection and opt-out option

11.1 We use Hotjar to better understand the needs of our users and to optimize the offerings on our websites. Using Hotjar's technology, we get a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click, what they like and what not, etc.) and that helps us to align our offer to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behavior of our users and their devices (in particular, the IP address of the device (is recorded and stored in anonymous form only), screen size device type (unique device identifiers), information about the used browser, location (only country), preferred language for displaying our website). Hotjar stores t information in a pseudonymous user profile. The information will not be used by Hotjar or by us to identify individual users nor will it be aggregated with other data about individual users. Further information can be found in Hotjar’s privacy policy here.

11.2 You can object to the storage of a user profile and information about your visit to our website by Hotjar and the setting of Hotjar tracking cookies on other websites.

III. Contact details

12.1 Controller

Fronius International GmbH

Froniusstraße 1

A-4643 Pettenbach

Austria

E-Mail: contact@fronius.com

Phone: +43 7242 241-0

Fax: +43 7242 241-3013

Fronius International GmbH，

12.2 Management

Elisabeth Engelbrechtsmüller-Strauß

12.3 Contact

For any inquiries related to data protection or data security, please contact us at the e-mail address dataprotection@fronius.com.

13. JURISDICTION

country specific information please click this link.