Privacy statement Robert Bosch GmbH

• Name of the service provider via which the online presence is accessed;
• Date, time, and duration of retrieval;
• Quantity of data transferred;
• Operating system and information about the Internet browser used, including installed add-ons (e.g., for the Flash player);
• http status code (e.g., "inquiry successful” or ”requested file not found”).

1.5 Children

This online offer is not meant for children under 16 years of age.

1.6 Transmission of data Name of the files and/or information retrieved;

1.6.1 Transmission of data to other responsible parties

As a rule, we transmit your personal data to other responsible parties only insofar as this is necessary for performance of the contract, if we or the third party have an overriding legitimate interest in transmitting the data or you have consented to this. Details regarding the legal basis may be found in the section “Purposes of processing and legal basis” (see No. 1.3). Third parties may also be other Bosch group companies. If data is transmitted to third parties on the basis of an overriding legitimate interest, this is explained in this privacy policy.

In addition, data may be transmitted to other responsible parties insofar as we are obligated to do so on account of legal regulations or an enforceable administrative or judicial order.

1.6.2 Transmission of data to service providers

We use external service providers for tasks such as marketing services, programming, data hosting, and hotline services. We have chosen these service providers carefully and supervise them on a regular basis, especially their careful handling and safeguarding of the data stored at these service providers. We bind all service providers to confidentiality and compliance with the legal regulations. Service providers may also be other Bosch group companies.

1.6.3 Transmission to recipients outside the EEA

We may also transmit personal data to recipients located outside the EEA in so-called “third countries”. In this case, we make certain prior to transmission that either an adequate level of data protection exists at the recipient’s (e.g., on the basis of an adequacy decision by the EU Commission for the respective country or agreement of so-called “EU standard contractual clauses of the European Union” with the recipient) or your consent to transmission is on file.

You can obtain from us an overview of the recipients in third countries and a copy of the specifically contracted provisions for ensuring an adequate level of data protection. For this, please use the information in the section “Responsible entity and contact” (see No. 11).

1.7 Duration of storage; retention periods

As a rule, we store your data as long as this is necessary to provide our online presence and the associated services or as long as we have a legitimate interest in continued storage (e.g., we may still have a legitimate interest in postal marketing even after fulfillment of a contract). In all other cases, we delete your personal data with the exception of data that we must continue to store in order to fulfill legal obligations (e.g., we are obligated to retain contracts and invoices for a specific period because of mandatory storage periods defined in tax law and commercial law).

• Name: Facebook Pixel
  Provider: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland Together with Facebook, we are responsible for the processing of your personal data within the context of the processing of your personal data on our online offering using Facebook Pixel. In order to define the respective responsibilities for the fulfilment of obligations in accordance with the GDPR for joint processing, we have concluded a shared responsibility agreement with Facebook. You can see the key points of the agreement at any time under the following link: https://www.facebook.com/legal/control-ler_addendum In particular, this governs what security measures Facebook must take into consideration (https://www.facebook.com/le-gal/terms/data_security_terms) and how the rights of data subjects can be asserted vis-à-vis Facebook.
  Function: Facebook processes your personal data on the basis of your consent through Facebook Pixel for the generation of campaign reports, conversion tracking, click events and targeted advertising outside our website (retargeting) on the basis of HTTP headers (including IP address, device and browser properties, URL, referrer URL, your person), Pixel-specific data (including Pixel ID and Facebook cookie), click behaviour, optional values (such as conversions, page type), form field names (such as “email”, “address”, “quantity” for purchasing a product or a service) We do not receive any personal data concerning you from Facebook, but rather receive anonymised campaign reports about the website target audience and ad performance. You can stop getting interest-based ads from Facebook by changing your advertising preferences on the Facebook website. Alternatively, you can deactivate the use of third-party cookies by visiting the Digital Advertising Alliance opt-out page at http://optout.aboutads.info/?c=2&lang=EN or the http://www.youronlinechoices.com website. You can find more information at: https://www.facebook.com/policy

• Name: Google Ads Remarketing Tag
  Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  Function: Google processes your personal data on the basis of your consent through “Google Ads Remarketing Tag” Pixel for the generation of campaign reports, conversion tracking, click events and targeted advertising outside our website (retargeting) on the basis of URL, referrer URL or inclusion on remarketing lists defined through us, for example. Using the above information, it is also possible for you to be associated with your Google account and included in remarketing lists. We do not receive any personal data concerning you from Google, but rather receive anonymised campaign reports about the target audience and ad performance. You can stop getting interest-based ads from Google by changing your advertising preferences on the Google website at https://www.google.com/settings/ads/onweb#display_optout. Alternatively, you can deactivate the use of third-party cookies by visiting the Network Advertising Initiative opt-out page at http://www.networkadvertising.org/managing/opt_out.asp or managing the use of device identification in the device settings. You can find instructions at https://support.google.com/ads/ans-wer/1660762#mob.You can find more information at: https://policies.google.com/privacy

2.2 Management of cookies and tracking mechanisms

You can manage your cookie and tracking mechanism settings in the browser and/or our privacy settings.

Note: The settings you have made refer only to the browser used in each case.

2.2.1 Deactivation of all cookies

If you wish to deactivate all cookies, please deactivate cookies in your browser settings. Please note that this may affect the functionality of the website.

2.2.2 Management of your settings with regard to cookies and tracking mechanisms not required technically

When visiting our websites, you will be asked in a cookie layer whether you consent to our using of any marketing cookies or tracking mechanisms, respectively. In our privacy settings, you may withdraw the consent with effect for the future or grant your consent at a later point in time.

In context of this processing, personal data is transmitted to the USA. The transmission is based on European Standard Contractual Clauses in which Microsoft guarantees to comply with the European data protection law for its provided services.

Further information on privacy in connection with Microsoft’s CDN service is available here: https://azure.microsoft.com/en-us/support/legal/. Microsoft’s privacy policy can be found here: https://privacy.microsoft.com/en-us/privacystatement.

4.2 Social plugins from Facebook

Facebook is provided at www.facebook.com by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA, and at www.facebook.de by Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland, ("Facebook"). An overview of Facebook plugins and their appearance may be found here:https://developers.facebook.com/docs/plugins/?locale=en_en; Information about data privacy on Facebook may be found here: http://www.facebook.com/policy.php.

4.3 Social plugins from Twitter

Twitter is operated by Twitter Inc., 1355 Market St., Suite 900, San Francisco, CA 94103, USA ("Twitter"). An overview of Twitter plugins and their appearance may be found here: https://developer.twitter.com; Information about data privacy on Twitter may be found here: https://twitter.com/en/privacy.

4.4 Social plugins from Xing

Xing is operated by XING SE, Dammtorstraße 30, 20354 Hamburg, Germany ("Xing"). An overview of Xing plugins may be found here:https://dev.xing.com; Information about data privacy on Xing may be found here: https://privacy.xing.com/en/privacy-policy

4.5 Social plugins from LinkedIn

LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA ("LinkedIn"). An overview of LinkedIn plugins may be found here: https://developer.linkedin.com/plugins; Information about data privacy on LinkedIn may be found here: https://www.linkedin.com/legal/privacy-policy.

5.1 Google reCAPTCHA

In certain cases we use the reCAPTCHA service of the company Google LLC to ensure appropriate data security for the use of contact forms. This serves above all for the differentiation of whether the input has been made by a natural person or fraudulently by machine or automated processing. This represents a predominant legitimate interest on our part within the meaning of article 6 section 1 lit. f GDPR. The service includes the sending of the IP address and if necessary other data required by Google for the reCAPTCHA service to Google. The deviating data protection regulations of Google LLC are applicable for this purpose.

Further information about the privacy policy of Google LLC are available at: https://www.google.com/intl/de/policies/privacy.

We will forward the personal da-ta you provide to the Bosch le-gal entity responsible for the processing of your query (for example, in the event your query refers to a product that is distributed by another Bosch legal entity). The legal basis for the processing of your data is our legitimate interest (Art. 6 para. 1 s. 1 lit. f GDPR) or, if applicable, an existing contractual relationship (Art. 6 para. 1 s. 1 lit. b GDPR). The processed person-al data is deleted 180 days upon receipt of your message the latest.

The use of the DemoUp Cliplister service is based on our overriding legitimate interest within the meaning of Art. 6 (1) lit. f DSGVO in the efficient provision of our online offering.

For more information about the scope and purpose of the collected data, the further processing and use of the data by DemoUp Cliplister, your rights, and the data protection options you can choose, please refer to DemoUp Cliplister’s privacy policy at https://www.demoup-cliplister.com/privacy-policy/.

(such as the IP address or the URL of the site on which the link is located), as the actions of third parties are by nature beyond our control. We do not assume any responsibility for the processing of such personal data by third parties.

and to protect any data of yours that we process from the risk of unintentional or unlawful destruction, manipulation, loss, change, or unauthorized disclosure or access. Our security measures are constantly being improved in line with technological developments.

12.5.2 Objection to data processing for the purposes of direct marketing

In addition, you can object at any time to the processing of your personal data for advertising purposes. Please note that, for organizational reasons, there may be an overlap between your objection and the use of your data in a campaign that is already running.

12.6 Right to withdraw consent

If you have consented to the processing of your data, you can withdraw this consent with future effect at any time. This also applies to withdrawal of consent given to us prior to the enactment of the General Data Protection Regulation (May 25, 2018). This does not affect the lawfulness of the processing of your data prior to withdrawal.

12.7 Right of complaint with supervisory authority

You have the right to lodge an appeal with a data protection supervisory authority. For this purpose, you can contact the data protection supervisory authority that is responsible for your place of residence or your federal state or the data protection supervisory authority that is responsible for us.

This is: State Commissioner for Data Protection and Freedom of Information

Address:

Königstraße 10a
70173 Stuttgart
GERMANY

Postal address:

Postfach 10 29 32
70025 Stuttgart
GERMANY

Telephone: +49 711 6155 41-0
Fax: +49 711 6155 41-15
e-mail to: poststelle@lfdi.bwl.de

Data Protection Officer

Information Security and Privacy (C/ISP)

Robert Bosch GmbH
Postfach 30 02 20
70442 Stuttgart
GERMANY

or via e-mail to: DPO@bosch.com

12.4.1. Rights of California “consumers” relating to Personal Information collected by Bosch

Individuals which fall within the definition of a “consumer” under the California Consumer Privacy Protection Act have the following rights relating to their Personal Information collected by Bosch.

1) Right to access specific information and data portability rights.

You have the right to request that Bosch discloses certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see below, “How to Exercise Your Rights”), we will disclose to you:

• a. The categories of Personal Information we collected about you.
• b. The categories of sources for the Personal Information we collected about you.
• c. Our business or commercial purpose for collecting or selling that Personal Information.
• d. The categories of third parties with whom we share that Personal Information.
• e. The specific pieces of Personal Information we collected about you.
• f. If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
• i. For “sales”, the Personal Information categories that each category of recipient purchased; and
• ii. for disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

2) Deletion Request Rights.

You have the right to request that Bosch delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

a. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

i. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

ii. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

iii. Debug products to identify and repair errors that impair existing intended functionality.

iv. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

v. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).

vi. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.

vii. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

viii. Comply with a legal obligation.

ix. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

12.4.2. Your Rights - Canadians

Individuals located in Canada have certain rights pursuant to Canadian Privacy Laws. Subject to certain exceptions and limitations, and depending upon the jurisdiction where you reside, such rights may include:

• a. The right to withdraw your consent to the collection, use or disclosure of your Personal Information.
• b. The right to be informed of the existence, use, and disclosure of your Personal Information, and to be provided with an account of the use that has been made or is being made of this information as well as the third parties to which it has been disclosed (including a list of organizations to which your information may have disclosed).
• c. The right to challenge the accuracy and completeness of your Personal Information, and have it amended, updated or rectified as appropriate.
• d. The right to acquire information about Bosch’s policies and practices with respect to Personal Information, including: a description of the type of personal information held by Bosch and a general account of its use; a copy of any brochures or other information that explain our policies, standards, or codes; and information about what Personal Information is shared with or accessible to our affiliates.
• e. The right to challenge Bosch’s compliance with the applicable Canadian Privacy Laws.

12.4.3. How to exercise your rights

To exercise your rights, please submit a verifiable consumer request or access request, as applicable, to us by either:

Calling us at (888-43-BOSCH (888-432-6724)).

Emailing us at: privacy.policy@us.bosch.com

Only you (or in case of a California resident, an authorized agent authorized by you to act on your behalf — see Section IV.6, Authorized Agent below for more information) may make a verifiable consumer request or access request, as applicable related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. Your verifiable consumer request or access request, as applicable, must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request or access request does not require you to create an account with us, but if you already have an account with us, you may be required to make your request through that account.

We will only use Personal Information provided in a verifiable consumer request or access request, as applicable, to verify the requestor’s identity or authority to make the request.

12.4.4. Response timing and format

We endeavor to respond to a verifiable consumer request or access request, as applicable, within forty five (45) days of its receipt, or sooner where required by applicable law (including Canadian Privacy Laws). If we require more time (up 90 days in total), where permitted by applicable law, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide in response to a verifiable consumer request will only cover the 12-month period preceding the verifiable consumer request's receipt, unless otherwise required by applicable law. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

For data portability requests, where applicable, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request or access request, as applicable, unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

12.4.5. Personal Information Sales: Opt-Out and Opt-In Rights

If you are 16 years of age or older, you have the right to direct us to not sell your Personal Information at any time (the “right to opt-out”). Furthermore, where required by applicable law in the relevant jurisdiction, we will obtain your consent prior to selling your Personal Information. We do not sell the Personal Information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is between 13 and 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to Personal Information sales may opt-out of future sales at any time.

To exercise the right to opt-out, you may submit a request to us by emailing us at contact@us.bosch.com. As noted above, certain kinds of third party cookies, such as ad network or analytics cookies, on the Bosch Website could be considered a “sale” of your Personal Information for purposes of the CCPA. In order to opt out of the “sale” of your information via such cookies, turn off the Analytics, Advertising, and Social Media cookies in our Privacy settings.

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize Personal Information sales. However, you may change your mind and opt back in to Personal Information sales at any time by changing your cookie preferences on Bosch Website “www.bosch-mobility.com”.

You do not need to create an account with us to exercise your opt-out rights. We will only use Personal Information provided in an opt-out request to review and comply with the request.

12.4.6. Authorized Agent

As a California resident you may also exercise your request to know or request to delete through an authorized agent. When you submit your request through an authorized agent we require that you:

• Provide us a copy of your written permission for the authorized agent to submit the applicable request; and
• Verify your own identity directly with us.

The foregoing does not apply when you have provided your authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4465; provided, that we may require a copy of such power of attorney before fulfilling any request.

12.4.7. Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not: (a) deny you goods or services; (b) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (c) provide you a different level or quality of goods or services; or (d) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

12.4.8. Filing a Complaint

Regulatory authorities that oversee the privacy laws and regulations, including the Office of the Privacy Commissioner of Canada, advise individuals to file an objection or challenge with the relevant company before lodging a formal complaint with a regulatory authority. If you are dissatisfied with Bosch’s response to an objection or challenge filed under Article IV.3 above, or you if wish to file a complaint with a regulatory authority first, you may do so as follows:

• Under PIPEDA: You may file a complaint with the Office of the Privacy Commissioner of Canada. Depending upon the province where you live, you may also (or instead) have the right to file a complaint with the applicable provincial privacy commissioner/regulator.
• Under PII Laws: You may file a complaint with the relevant state’s Attorney General’s office.
• Under the CCPA: You may file a complaint with the California Attorney General’s Office. For additional information regarding consumer complaints against a business/company under the CCPA and to initiate the complaint process, please click on the link.

Please always consult the current version of our data protection policy, as this is subject to change.

Last revised: April 12, 2024