Privacy Notice for Connected Appliances Services

We are delighted that you have shown interest in our home appliance connected to the Wi-Fi ("Connected Appliance"). Group (as defined below) takes your data protection rights very seriously and we are very committed to improving your customer experience in compliance with all applicable data protection laws and regulations. Please find below our Privacy Notice for Appliances Connected to the Wi-Fi Network, which explains the way we process your personal data.

* * * * *

When your Connected Appliance is connected to Whirlpool’s Connected Appliance network, it is capable of transmitting information to Whirlpool and providing you with services and notifications.

In addition, you may use software applications provided by Whirlpool (the "Application" or "Applications") on your mobile device to manage your Connected Appliance remotely and access associated functions and services. This Privacy Notice applies to your use of the Connected Appliance and the Applications (jointly, the "Connected Appliance Services").

In light of the above, Whirlpool EMEA S.r.l., a company incorporated under the laws of Italy, part of the Group (" Group"), having its registered office in Via Varesina n.204, 20156 Milano (MI), Italy, email: data_protection_emea@europeanappliances.com ("Whirlpool", "us" or "we"), in its capacity as data controller, intends to provide individuals, including but not limited to the users ("Users", "you" or "your") with information concerning the methods used for collecting and processing your personal data for the purpose of using the Connected Appliance Services, in accordance, with the European General Data Protection Regulation no. 679/2016 ("Regulation") and any other applicable local laws and regulations.

1. TYPE OF PERSONAL DATA PROCESSED

 

Whirlpool will process the following categories of data:

 

1. Personal data directly provided to Whirlpool

When you register your Connected Appliance, you provide Whirlpool with the following personal data: name, surname, address of residence and/or domicile, email address and mobile phone number.


We assume that the personal data we collect and process for the purposes of this Notice actually comes from you, however we cannot exclude they may also be relevant to other individuals. In such cases, you are responsible for the provision of such data to us.

 

2. Information Automatically Collected By Whirlpool

Once you have registered your Connected Appliance, Whirlpool will also automatically collect the following types of information from the following sources on a periodic basis:

 

• Connected Appliance: your Connected Appliances ID (including model and serial number), source IP address, appliance status (e.g., refrigerator temperature, water filter status), and fault/error codes (e.g., "door ajar");

 

• Other devices: if you choose to use third party devices, such as smart meters, to manage your energy consumption or to use other related Connected Appliance features, Whirlpool may collect information such as your total home energy consumption, the energy consumption of your Connected Appliance, and your utility electric or gas rate plan (or your area’s general rate plan). Such information may also include personal data and they shall be subject to the privacy policies and procedures of the relevant third parties providers.

 

• Applications: if you use the Applications, Whirlpool will automatically gather and store certain information about your visit and actions performed within the Application such as changes to your account settings and operations executed on your Connected Appliance.

 

3. Transmission of Connected Appliance Data

If you would prefer to not have Whirlpool collect any data from your Connected Appliance, you will need to de-provision (disconnect) your Connected Appliance from your wireless router AND turn off the wireless connection button on your appliance. De-provisioning (disconnecting) your Connected Appliance will also disable your use of the Connected Appliance Services, even if your Connected Appliance Services account remains active. If you merely deactivate your Connected Appliance Services account but do not de-provision (disconnect) your Connected Appliance, data, which do not include and are not associated with your personal data and does not identify you specifically, will continue to be transmitted to Whirlpool.

 

4. Other Device Data

Any optional services that you activate through the Application, including services associated with third party devices (e.g. smart meters for energy consumption management services) can be deactivated by you at any time through the Application.

 

2. PURPOSES OF THE PROCESSING

 

Where applicable, we will process your personal data we have collected or been provided with for the following purposes:

 

1. administrative and accounting purposes;
2. providing you with the Connected Appliance Services, including notifications for purposes of assistance and maintenance and communications functional to using your account or you appliance, including those related to customer services and the warranty;
3. complying with the statutory provisions and regulations and enforcing its own rights before the Courts;
4. upon your prior consent, and without prejudice to Whirlpool's legitimate interest, sending you customized marketing communications related to our products and services electronically (including email, SMS, MMS, social network notifications, mobile applications);
5. upon your prior consent, sharing your personal data for customized marketing communication with our selected trusted partners as set forth in Section 6 below ; and
6. unless you opt-out, contacting you for marketing purposes by phone (non automated) and via paper mail;
7. for the purpose of sending you customer care communications concerning products registered by you or which you showed interest in and in order to carry out customer satisfaction surveys;
8. sharing your data only in an anonymous and aggregated form with (i) our business partners and /or other third parties for research and development purposes and (ii) other consumers to help them comparing their energy usage to other Connected Appliance Users. To do so, Whirlpool may store such aggregated data for a reasonable period of time after you deactivate your Connected Appliance Services account or stop using the Connected Appliance Services;
9. providing you with suggestions within the Application to improve the performance of the Connected Appliances (e.g., alternative cycles or energy consumption, what products to use to maintain the appliance in peak shape or to improve performances, accessories or components to add, increase or restore functionalities, etc.) or links through which you can access information on the web suggesting you products or services;
10. after-sales and customer care assistance concerning the Connected Appliance or the Connected Appliances Services, the Application or the Applications, as well as in order to carry out market surveys, based on aggregate / anonymized personal data;
11. carrying out activities useful for the transfers of business and business branches, takeovers, mergers, demergers or other transformations and for the execution of such transactions.

 

3. LEGAL BASIS FOR THE PROCESSING

 

1. The provision of the personal data for the purposes under Section 2, para. a) and b) is necessary for activating and allowing you the use of the Connected Appliance Services.
2. The provision of personal data for the purposes under Section 2, para. c), is mandatory since required by the applicable laws.
3. The provision of your Personal data for the purposes of Section 2, para. d) and e), is optional. In the absence of your consent, Whirlpool, the companies part of the Group and/or trusted partners will not be able to send you customized marketing communications via automated means. In any event, upon the withdrawal of the Users' consent we will no longer process the personal data for the purposes of para. d) and e) above;
4. The provision of your personal data for the purposes pursuant to Section 2, para. f), g), h), i), j) and k) is necessary to pursue the legitimate interests of Whirlpool and the Group, which will be appropriately balanced with your interests.

 

We may also use, in compliance with the applicable data protection laws, your electronic contact details (email, phone number) we collected in the context of a sale of a product or service, in order to send you customized marketing communications related to similar products or services. In such a case, you may object to such use of your electronic contact details by clicking the “unsubscribe” link at the bottom of the email / SMS at each time the customized marketing communication is sent; or in accordance with Section 10 of this Privacy Notice below.

 

4. DATA RETENTION

 

Whirlpool will process the personal data for as long as it is necessary to achieve the intended purposes pursuant to Section 3 above. In any case, the following retention periods shall apply:

 

1. the data collected for the purposes of Section 3, para. a), b) and c), will be retained for the period strictly necessary in order to respond to data subjects' requests and comply with applicable laws and regulations;
2. the data collected for the purposes of Section 3, para. d), e), f) and g) will be retained for the maximum data retention period set forth by the applicable law provisions and, in any event, will be deleted if you withdraw your consent;
3. the data collected for the purpose of Section 3, para. f), will be retained for the amount of time which Whirlpool shall deem appropriate irrespectively of any applicable provision, in light of their nature of anonymous/aggregated data and therefore neither subject to the Regulation nor to any other applicable law or regulation;
4. the data collected for the purpose of Section 3, para. g), h) and i), will be retained for the period strictly necessary in order to pursue Whirlpool legitimate interests.

 

Please consider that data retention periods may vary, depending on the applicable local laws.

 

5. DATA PROCESSING PROCEDURES

Your personal data is processed with the support of Information Technology and/or paper means and it is protected by appropriate security devices suitable to ensure the secrecy and safety of the personal data. In particular, Whirlpool adopts the appropriate administrative, technical, personal and physical measures designed to safeguard the personal data held against any loss, theft as well as unauthorised use, disclosure or change in the personal data.

 

6. COMMUNICATION OF DATA

 

We will only share your personal data with our trusted partners, such as our extended warranty providers, that intend to use it for direct marketing purposes as autonomous data controllers when we have specifically informed you and you have given us specific consent to do this. We may share your personal data with:

1. companies of the Group located in the EEA and outside the EEA, acting as autonomous controllers;;
2. our carefully chosen third party suppliers located in the EEA and outside the EEA, such as call centre operators, shippers, suppliers of services or technicians assigned to assistance and other suppliers working on our behalf in the role of duly appointed data processors for the purposes described in this Notice;;
3. other third parties as part of a corporate transaction such as a merger or sale of assets.

In the above cases, these companies must abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose.

 

Your personal data are stored on IBM servers within the EU. Should an extra-EEA transfer occur, we will implement suitable safeguards in accordance with the Regulation. See in particular Section 7 below.

 

 

7. EU-U.S. PRIVACY SHIELD AND SWISS-U.S. PRIVACY SHIELD

 

Whirlpool Corporation participates in and has certified its compliance with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. Whirlpool Corporation is committed to subjecting all personal data received from EU member countries and Switzerland, in reliance on the Privacy Shield Frameworks, to the Frameworks’ applicable Principles.  To learn more about the Privacy Shield Frameworks, visit the U.S. Department of Commerce’s Privacy Shield List. [https://www.privacyshield.gov/list]

 

Whirlpool Corporation is responsible for the processing of personal data it receives, under the Privacy Shield Frameworks, and subsequently transfers to a third party acting as an agent on its behalf.  Whirlpool Corporation complies with the Privacy Shield Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions.

 

With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Whirlpool is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. 

 

In certain situations, the Group may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

 

If you have an unresolved privacy or data use concern related to the Privacy Shield Framework that you believe we have not addressed satisfactorily, you may contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.  

 

Under certain conditions, more fully described on the Privacy Shield website [https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint], you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

 

<div><a href="//privacy.truste.com/privacy-seal/validation?rid=539ed238-e74a-4d99-88ae-7a48443c1f12" target="_blank"><img style="border: none" src="//privacy-policy.truste.com/privacy-seal/seal?rid=539ed238-e74a-4d99-88ae-7a48443c1f12" alt="TRUSTe"/></a></div>

 

8. MINORS UNDER THE AGE OF 18

 

Whirlpool does not address subjects under the age of 18, nor is Whirlpool knowingly collecting personal data from people under the age of 18.

 

9. PREFERENCES AND SERVICE NOTIFICATIONS

 

1. Connected Appliance Notifications

You may choose to receive notifications via the Application (e.g., notifications regarding cycle completion or when your refrigerator door is ajar) as part of the Connected Appliance Services. You may change your preferences regarding these notifications, including which notifications to receive or disabling such notifications, by logging in to your Connected Appliance Services account through the Application.

 

2. Deactivation (de-registration) of your account

You may choose to deactivate (de-register) your account at any time by writing at data_protection_emea@europeanappliances.com. If you deactivate your account, collected data related to your Connected Appliance and your use of the Connected Appliance Services will be retained by Whirlpool and/or Group in anonymized and aggregated form for some of the purposes described in Section 2 above. This means it will no longer be associated with your personal data and therefore will be irreversibly anonymized. Deactivating your Connected Appliance Services account will stop you from receiving further notifications, services and promotions relating to your Connected Appliance.

 

3. Disabling the Application(s)

You may also choose to disable the Application by uninstalling it from your device. In this latter case we need to inform that the Connected Appliance will continue to transmit your information even though we will not be receiving it, therefore, it is important that you turn off Wi-Fi on the Connected Appliance in case you want us not to collect your data anymore.

 

4. Service and Other Safety Notifications

As long as you have not de-registered from the Connected Appliance Services, Whirlpool reserves the right to contact you in the event of a safety or service notification for your Connected Appliance, such as product recall notices, regardless of your stated privacy preferences.

 

 

 

10. RIGHTS OF DATA SUBJECTS

 

You, at any time and at no charge, can have and/or exercise the following rights:

 

1. the right to be informed on the purposes and methods of the processing of your personal data;
2. the right of access to your personal data (commonly known as “data subject access request”). This enables you to receive a copy of the personal data we hold about you;
3. the right to ask for updating or rectification of the personal data we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us;
4. the right to request erasure of your personal data. This enables you to ask us to delete or remove data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
5. the right to restrict the processing of your personal data in some specific cases;
6. the right to object to the processing, wholly or partly, in presence of legitimate grounds. Please be aware that in such cases the Company may not be able to deliver the Connected Appliances Services to you;
7. where we are relying on consent to process your personal data, the right to revoke the consent to the processing of your personal data freely and at any time, also by clicking on the unsubscribe option at the bottom of our marketing communications;
8. the right to data portability of your personal data to you or to a different provider. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format;
9. the right to contact us at data_protection_emea@europeanappliances.com; and
10. the right to lodge a complaint in front of the competent national data protection or judicial authority.

 

If you wish to exercise the rights mentioned above, or raise any questions about the personal data we hold about you, please contact us at data_protection_emea@europeanappliances.com or write to us at: Whirlpool EMEA S.r.l., Via Varesina n.204, 20156 Milano (MI), Italy, for the attention of the Data Protection Office.

 

11. AMENDMENTS AND UPDATES

 

We keep this Privacy Notice under regular review. This Privacy Notice was last updated in May 2018.

 

* * * *