Data protection

As a rule:

• your essential personalization information;
• details about the company you represent;
• your contact details;

Depending on your activity:

• technical identifiers;
• consents you have provided to us;
• behavioural data (for instance, how you have interacted with our digital services);
• your payment information;

Below are examples of data attributes:

• your given name and surname;
• job role and title;
• company name;
• work-related address, e-mail address, and phone number;
• usernames and passwords (stored in encrypted form);
• direct marketing consents;
• data on your behaviour on our websites, along with how you respond to our direct marketing emails;
• travel information and preferences;
• information that allows credit card payments to be made;
• details of business transactions between you or your company and us;
• information required for possible background checks, such as date of birth and nationality;

The following personal data will be processed for Chinese customer contacts:

• Full name
• Salutation (gender)
• Company email address
• Personal email address
• Job position or title
• Phone number
• Mobile number
• Fax number
• Company name
• Usernames and passwords
• Cookie information (covering your internet protocol (IP) address, your computer’s operating system, the type of browser you use, and the address of any site that referred you)
• Home address
• Data subject's account/username (e.g. WeChat account, QQ account, Tik Tok account, etc)
• Passport and/or identity document required for the trip (may be sensitive personal data)
• Details of the itinerary and/or accommodation booked for a business trip (this may count as sensitive personal data)

Overall responsibility and ultimate decision-making authority rests with Konecranes Plc (established in Finland, the parent company of Konecranes Group). Konecranes Global Corporation (also established in Finland) bears limited responsibility for the centralized IT systems/applications of Konecranes Group (incl. subcontracting), as well as for international transfers of personal data outside the EU/EEA

To reach us, send an email to data.protection(a)konecranes.com

For Chinese customer contacts, kindly note:

Our legitimate interest in conducting business with the company you represent gives us a lawful basis to process your personal data.

For Chinese customer contacts, the legal basis for processing their personal data is generally consent. However, under the applicable laws, your consent is not required for us to process your personal data in the following situations:

• processing is required to enter into or carry out a contract to which the individual is a party, or to conduct human resource management under labor rules and policies established in accordance with the laws, and a collective contract concluded in accordance with the laws;
• processing occurs where needed to carry out functions or obligations imposed by statute;
• processing is carried out when needed to address public health emergencies, or to safeguard the life, health, or property of natural persons during emergency circumstances;
• personal data is handled to a reasonable extent for purposes such as news reporting, supervision based on public opinion, or other activities serving the public interest;
• personal data disclosed by the individuals themselves, or other personal data lawfully disclosed, is processed to a reasonable extent in accordance with the Laws; or
• in any other situation set out under a law or administrative regulation.

Exception for Vietnamese contacts:

In general, processing your personal data is necessary so that we can carry out direct and indirect business transactions with the company you represent - for example, receiving orders and delivering products and services (direct), and developing our internal processes and systems that support these transactions (indirect). Konecranes applies artificial intelligence (AI) in processing personal data and may also use personal data to train AI models or systems. The purposes for which such training occurs are clearly defined and strictly limited, and AI will never be trained for any purpose beyond those explicitly listed below. Notably, personal data controlled by Konecranes is never used to train AI models or systems outside of Konecranes, meaning it will not be used to develop or improve any third-party or supplier AI system.

Specifically, your personal data is used by us for the purposes set out below:

1. Business development and reporting;
2. Quality management;
3. Researching and developing products and services;
4. Running, overseeing, maintaining, and carrying out research and development on our processes, IT services, and infrastructure;
5. Marketing activities;
6. Sales activities;
7. Customer relationship management ("CRM");
8. Manufacturing of products;
9. Supplying products and services (incl. granting access to Konecranes Group digital channels and keeping records of the product/service training customer contacts have completed);
10. Handling invoicing, taxation, and related financial transactions; and
11. Maintaining the integrity of the Konecranes Group's business environment and processes (incl. monitoring systems and security to prevent or look into misuse, as circumstances may require);
12. Performing background studies on customers (incl. their customer contacts where relevant);
13. Organizing events;
14. Protecting personnel safety (incl. customer contacts); and
15. Keeping archives of inactive personal data for other purposes of use, following the defined retention rules;
16. Exercising and/or defending the company's rights and obligations;

Your personal data may also be used to enhance customer experience and to develop products and services through analysis of your interests. We may also analyse data gathered from our communications and interactions with you to assess needs for further customer relationship management and/or sales-related activities.

Based on the data collected, we may sort customers and customer contact persons into categories so that our services can be better targeted to you, including in marketing, satisfaction surveys, and sales-related communications. This categorization relies partly on automated decision-making; for example, we may categorize you automatically according to how you respond to our marketing messages. Nevertheless, our automated decision-making does not have legal or similarly significant effects on you. Categorization is carried out at a general level, and only a limited amount of your personal data is used for this purpose.

For China customer contacts-

The purposes for which your personal data is processed are as follows:

Your sensitive personal data is processed for the following purposes:

Why our processing of your sensitive personal data is necessary:

How our processing of your sensitive personal data affects data subjects’ personal rights and interests: should a third party misuse the personal data, this could harm the data subject’s privacy and personal dignity, or cause damage to bodily or property safety if such sensitive personal data is accidentally leaked.

When we handle your personal data (including sensitive personal data), this encompasses several stages: collecting, storing, using, transmitting, providing, and deleting it.

We use your personal data to enable and assist you in carrying out your employment duties connected with business transactions between us and the company you represent.

At all times, you retain the right to:

• Object the processing of your personal data on the grounds of our legitimate interest; and
  • "NEVERTHELESS, IN LINE WITH MANDATORY DATA PROTECTION LAWS, KONECRANES HAS ALREADY CARRIED OUT IN ADVANCE A COMPREHENSIVE BALANCING TEST WEIGHING YOUR RIGHTS AGAINST KONECRANES' INTERESTS, THEREBY DULY CONSIDERING AND SAFEGUARDING YOUR RIGHTS AND FREEDOMS IN THE PROCESSING OF PERSONAL DATA."
• Decline to receive further direct marketing messages and materials from us.

In addition, you are entitled at any time to:

• Obtain access to your personal data;
• Confirm that your personal data is accurate;
• Request that any incomplete, inaccurate or outdated personal data concerning you be corrected, modified or deleted; and
• In certain situations, limit how your personal data is processed;
• In certain situations, have us forget you entirely; and
• File a complaint with a supervisory authority.

These rights can be exercised by emailing us at data.protection(a)konecranes.com or by completing the form at

Chinese customer contacts, as data subjects, additionally hold the following legal rights under China's data protection laws:

In compliance with mandatory data protection laws, we have carried out a comprehensive analysis of the risks that our processing of Customer Contact Data could pose to your rights and freedoms.

As is the case with any data processing activity, our processing also carries certain risks, relating mainly to

• how confidential your  personal data remains;
• general matters of data security; and 
• the possibility that you may be unable to access our systems and services.

That said, the severity of these risks has been assessed as low, with only a remote likelihood of occurrence. Furthermore, we actively work to mitigate these risks, i.a.through:

• continuously training our personnel,
• supplying and continuously developing detailed instructions; and
• putting in place and continually improving our data security practices.

We gather your personal data:

• directly from you, e.g. when you sign up for our digital services, attend a sales meeting, or speak with us by phone;
• from your managers or coworkers;
• from within our own staff or via our business partners; and
• to some degree, through monitoring how you behave while using our digital services.

Yes, in certain cases your personal data may be transferred outside the EU/EEA:

• For such international transfers, we rely on either EU Commission adequacy decisions or EU Commission standard contractual clauses (controller-to-processor type, EU Commission decision 2021/914/EU) as suitable or appropriate safeguards. To find out which transfer mechanism applies, please contact us at data.protection(a)konecranes.com.
• within our corporate group, as well as to external business partners that provide services to us.

Your personal data may be transferred for processing to the following countries:

We engage reliable subcontractors to supply us, e.g. with IT services that support our personal data processing - such services include, among others, the provision of various infrastructure, software and applications routinely used for contact data processing within global corporate groups.

• In accordance with mandatory data protection legislation, we consistently require our personal data service providers to sign binding data processing agreements with us (e.g. as mandated by the EU GDPR).

Generally, we do not release your data beyond our effective control, unless required to do so by law, such as when a court, the police, or another law enforcement agency has requested it.

Your data may also be shared, to a limited extent, with our trusted business partners, such as banks, insurance companies, auditors and legal advisors.

We safeguard your personal data through technical and organizational measures designed to prevent accidental and/or unlawful access, alteration, destruction, or other processing, including unauthorized disclosure or transfer of your personal data.

These measures include, without being limited to, adequate firewall arrangements, suitable encryption of communications and messages, and the use of secure, monitored equipment and server rooms. Data security receives particular attention when third parties (e.g. data processing subcontractors) are engaged to provide and implement IT systems and services.

We properly observe data security requirements when managing and monitoring access to IT systems. Staff who process your personal data as part of their duties receive training and appropriate instruction on data protection and data security matters.

No later than ten (10) years following the last business activity in which you were involved.

Furthermore, where circumstances require it, we may need to extend the retention of your personal data for the establishment, exercise or defence of legal claims, or for carrying out our internal investigations.

Regarding China customer contacts –

Providing your personal data is not a legal obligation; however, certain personal data is necessary to carry out or enter into a business activity with us (such as a business contract).

As a rule:

• your essential personalization information;
• details about the company you represent;
• your contact details;

Depending on your activity:

• technical identifiers;
• behavioural data (for instance, how you have interacted with our digital services);

Examples of such attributes are:

• your given name and surname;
• job role and title;
• company name;
• work-related address, e-mail address, and phone number;
• usernames and passwords (stored in encrypted form);
• behavioural data collected from our websites;
• attendance records relating to our events;
• details of business transactions between you or your company and us;
• information required for possible background checks, such as date of birth and nationality;

Personal data processed for Chinese vendor contacts includes the following:

• Full name
• Salutation (gender)
• Company email address
• Personal email address
• Job position or title
• Phone number
• Mobile number
• Fax number
• Company name
• Usernames and passwords
• Home address
• ID (individual vendors only) - (may constitute sensitive personal data)
• Bank account (individual vendors only) - (may constitute sensitive personal data)
• Passport and/or identification for business travel - (may constitute sensitive personal data)
• Travel itinerary and/or lodging arrangements for business trips - (may constitute sensitive personal data)

Konecranes Plc (incorporated in Finland, the parent company of the Konecranes Group) holds overall responsibility and ultimate decision-making authority. Konecranes Global Corporation (incorporated in Finland) bears limited responsibility for the Konecranes Group's centralized IT systems/applications (incl. subcontracting) and for international transfers of personal data outside EU/EEA.

To reach us, send an email to data.protection(a)konecranes.com

Chinese vendor contacts should note the following:

Our legitimate interest in conducting business with the company you represent gives us a lawful basis to process your personal data.

For Chinese vendor contacts, the legal basis for processing their personal data is typically consent. However, under the applicable laws, your consent is not required for us to process your personal data when:

• processing is required to enter into or carry out a contract to which the individual is a party, or to conduct human resource management under labor rules and policies established in accordance with the laws, and a collective contract concluded in accordance with the laws;
• processing occurs where needed to carry out functions or obligations imposed by statute;
• processing is carried out when needed to address public health emergencies, or to safeguard the life, health, or property of natural persons during emergency circumstances;
• personal data is handled to a reasonable extent for purposes such as news reporting, supervision based on public opinion, or other activities serving the public interest;
• personal data disclosed by the individuals themselves, or other personal data lawfully disclosed, is processed to a reasonable extent in accordance with the Laws; or
• in any other situation set out under a law or administrative regulation.

Exception for Vietnamese contacts:

In general, processing your personal data is necessary for us to carry out successful direct and indirect business transactions with the company you represent - for example, placing orders and receiving products and services  (direct), as well as developing our internal processes and systems that support these transactions (indirect). Konecranes applies artificial intelligence (AI) to the processing of personal data and may also use personal data to train AI models or systems. The purposes for which AI is trained are precisely defined and narrowly limited. AI will under no circumstances be trained for purposes other than those explicitly listed below. Importantly, personal data controlled by Konecranes is never used to train AI models or systems outside of Konecranes. This means personal data will not be used to develop or improve third-party or supplier AI systems.

Specifically, your personal data is used by us for the purposes set out below:

1. Business development and reporting;
2. Quality management;
3. Running, overseeing, maintaining, and carrying out research and development on our processes, IT services, and infrastructure;
4. Purchasing activities;
5. Inventory management and activities;
6. Manufacturing of products;
7. Providing products and services;
8. Managing relationships with vendors and subcontractors (including, where relevant, access to KC Group digital channels, IT systems and products);
9. Handling invoicing, taxation, and related financial transactions;
10. Maintaining the integrity of the KC Group business environment and processes (incl. system/security monitoring to prevent or detect misuse, as circumstances may require);
11. Carrying out due-diligence background checks on vendors (including, when needed, their contacts);
12. Organizing events;
13. Keeping archives of inactive personal data for other purposes of use, following the defined retention rules; and
14. Safeguarding personnel safety (incl. vendor contacts);
15. Exercising and/or defending the company's rights and obligations;

Regarding China vendor contacts –

Your personal data is processed for the following purposes:

We process your sensitive personal data for the following purposes:

In the case of individual vendors, your sensitive personal data is processed for the following purposes:

Why our processing of your sensitive personal data is necessary:

How our processing of your sensitive personal data affects data subjects’ personal rights and interests: should a third party misuse the personal data, this could harm the data subject’s privacy and personal dignity, or cause damage to bodily or property safety if such sensitive personal data is accidentally leaked.

When we handle your personal data (including sensitive personal data), this encompasses several stages: collecting, storing, using, transmitting, providing, and deleting it.

We use your personal data to enable and assist you in carrying out your employment duties connected with business transactions between us and the company you represent.

At all times, you retain the right to:

• Object the processing of your personal data on the grounds of our legitimate interest; and
  • "NEVERTHELESS, IN LINE WITH MANDATORY DATA PROTECTION LAWS, KONECRANES HAS ALREADY CARRIED OUT IN ADVANCE A COMPREHENSIVE BALANCING TEST WEIGHING YOUR RIGHTS AGAINST KONECRANES' INTERESTS, THEREBY DULY CONSIDERING AND SAFEGUARDING YOUR RIGHTS AND FREEDOMS IN THE PROCESSING OF PERSONAL DATA."
• Withdraw from receiving any direct marketing communications and materials from us

In addition, you are entitled at any time to:

• Obtain access to your personal data;
• Confirm that your personal data is accurate;
• Request that any incomplete, inaccurate or outdated personal data concerning you be corrected, modified or deleted; and
• In certain situations, limit how your personal data is processed;
• In certain situations, have us forget you entirely; and
• File a complaint with a supervisory authority.

To exercise these rights, you may email us at data.protection(a)konecranes.com or by completing the form at

In relation to vendor contacts based in China, those individuals are additionally granted the legal rights set out below under China's data protection laws:

In line with mandatory data protection laws, we have carried out a comprehensive risk analysis regarding how our processing of Vendor Contact Data could affect your rights and freedoms.

As is the case with any data processing activity, certain risks cannot be entirely excluded in ours, relating chiefly to

• how confidential your  personal data remains;
• general matters of data security; and
• the possibility that you may be unable to access our systems and services.

That said, these risks have been assessed as low, with only a remote likelihood of occurring. In addition, we actively reduce these risks, i.a.by:

• continuously training our personnel,
• supplying and continuously developing detailed instructions; and
• putting in place and continually improving our data security practices.

We gather your personal data:

• directly from you, e.g. when you sign up for our digital services, attend a sales meeting, or speak with us by phone;
• from your managers or coworkers;
• from within our own staff or via our business partners; and
• only to a restricted degree, through monitoring how you interact with our digital services.

Yes, in certain cases your personal data may be transferred outside the EU/EEA:

• For this purpose we rely on either EU Commission adequacy decisions or EU Commission standard contractual clauses (of the controller-to-processor type, EU Commission decision 2010/87/EU), as appropriate or suitable safeguards for these international data transfers. To obtain access to the relevant transfer mechanism, please contact us at data.protection(a)konecranes.com.
• within our corporate group, as well as to external business partners that provide services to us.

Your personal data may be transferred for processing to the following countries:

We engage reliable subcontractors to supply us, e.g. with IT services that support our personal data processing - such services include, among others, the provision of various infrastructure, software and applications routinely used for contact data processing within global corporate groups.

• In accordance with mandatory data protection legislation, we consistently require our personal data service providers to sign binding data processing agreements with us (e.g. as mandated by the EU GDPR).

Generally, we do not release your data beyond our effective control, unless required to do so by law, such as when a court, the police, or another law enforcement agency has requested it.

Your data may also be shared, to a limited extent, with our trusted business partners, such as banks, insurance companies, auditors and legal advisors.

We safeguard your personal data through technical and organizational measures designed to prevent accidental and/or unlawful access, alteration, destruction, or other processing, including unauthorized disclosure or transfer of your personal data.

These measures include, without being limited to, adequate firewall arrangements, suitable encryption of communications and messages, and the use of secure, monitored equipment and server rooms. Data security receives particular attention when third parties (e.g. data processing subcontractors) are engaged to provide and implement IT systems and services.

We properly observe data security requirements when managing and monitoring access to IT systems. Staff who process your personal data as part of their duties receive training and appropriate instruction on data protection and data security matters.

No later than ten (10) years following the last business activity in which you were involved.

Furthermore, where circumstances require it, we may need to extend the retention of your personal data for the establishment, exercise or defence of legal claims, or for carrying out our internal investigations.

Regarding China vendor contacts –

Providing your personal data is not a legal obligation; however, certain personal data is necessary to carry out or enter into a business activity with us (such as a business contract).

• Your essential personalization information;
• Your contact details;
• The consent you have provided to us;
• Details of your education and professional training;
• Details of your prior employment history (where applicable);
• Your own assessment of skills relevant to the position (e.g. IT and language skills)
• Key attributes and expectations (e.g. salary) relating to the specific role in question (depending on the case);
• Your CV, cover letter and, where applicable, a video interview;
• Technical identifiers;
• A limited set of occupational health data (where applicable);

Additionally, for candidates in the US:

• Previous employer’s supervisor name;
• Address and telephone number of the previous employer;

Additionally, for candidates applying for a position in the US and/or Canada:

• Social security number;
• Age;
• Gender;
• Race;
• Ethnicity;
• Veteran status;
• Voluntary Self-Identification of Disability;
• Salary expectation;
• Application statement;
• Reference details (referee’s name, email address and phone number);
• Details of relatives employed by Konecranes (name, relationship, work location);
• Whether you are willing to take part in a recruitment interview and/or drug screening or breath alcohol testing;
• Discharge or reassignment information;
• Need for sponsorship of employment visa status;
• Your citizenship and whether you may legally work in the US;
• Any existing non-compete or other restrictive covenant;
• State Tax Credit screening related optional data:
  • Whether you hold, for the work opportunity credit, a conditional certificate granted by the state workforce agency (SWA) or by a local agency member;
  • Having served in the military for 180 days or more;
  • Receiving Cash assistance (AFDC/TANF benefits);
  • Being a recipient of assistance for child care, housing or transportation;
  • Having a felony conviction or deferred adjudication for a felony charge;
  • Receiving a Supplementary Security Income (SSI) check;
  • Use of Vocational rehabilitation services;
  • Recipient of Food Stamps;
  • Continuous unemployment;

Additionally, for candidates being hired into a position in the US and/or Canada, the following onboarding information:

• Full Legal Name;
• Date of Birth;
• Former/Alternative names;
• The address to which mail is presently sent (street address or post box, city, state, zip);
• Name of family member and the nature of the relationship;
• Marital status;
• Driver's license number, the state that issued it, and its expiration date;
• Payroll identification number for the employee (ssn);
• Routing/transit/aba no.;
• Bank account number;
• Bank account holder's name;
• Bank name;
• Type of deposit;
• Type of account;
• Checking/savings from salary;
• Employee file number;
• Bank telephone number;
• Bank transit number;

Additionally, for candidates applying for a position in China:

• Full name
• Gender
• Date of birth
• Nationality
• Nation
• Native place
• Mobile number
• Phone number
• Home address
• Personal email address
• Education qualification
• Education degree
• Education background
• Work experience
• Training record
• Marriage status
• Qualification certificates
• Professional title

Konecranes Plc (incorporated in Finland, the parent company of the Konecranes Group) holds overall responsibility and ultimate decision-making authority. Konecranes Global Corporation (incorporated in Finland) bears limited responsibility for the Konecranes Group's centralized IT systems/applications (incl. subcontracting) and for international transfers of personal data outside EU/EEA.

To get in touch with us, please send an email to data.protection(at)konecranes.com

Please note the following for candidates applying for a position in China:

We base our processing of your personal data on three lawful grounds, which both permit and require it:

• Your consent, as given to us;
• Compliance with our mandatory legal obligations, together with your rights arising from your status as our employee candidate; and
• Our legitimate interest consists in supporting our recruitment-related business processes, including the initial evaluation of prospective employee candidates and the supply of the IT resources needed to support the recruitment process.

For candidates applying for a position in China, consent is normally the legal basis on which their personal data is processed. Under the applicable laws, however, your consent is not needed for us to process your personal data when:

• processing is required to enter into or carry out a contract to which the individual is a party, or to conduct human resource management under labor rules and policies established in accordance with the laws, and a collective contract concluded in accordance with the laws;
• processing occurs where needed to carry out functions or obligations imposed by statute;
• processing is carried out when needed to address public health emergencies, or to safeguard the life, health, or property of natural persons during emergency circumstances;
• personal data is handled to a reasonable extent for purposes such as news reporting, supervision based on public opinion, or other activities serving the public interest;
• personal data disclosed by the individuals themselves, or other personal data lawfully disclosed, is processed to a reasonable extent in accordance with the Laws; or
• in any other situation set out under a law or administrative regulation.

As a general matter, processing your personal data is necessary for us to carry out and support the recruitment of personnel into Konecranes Group (including related support functions such as IT). Konecranes applies artificial intelligence (AI) when processing personal data, and personal data may also be used to train AI models or systems. The purposes for which AI training is carried out are precisely defined and narrowly limited. AI will never, under any circumstances, be trained for a purpose beyond those explicitly listed below. It is important to note that personal data under Konecranes' control is never used to train AI models or systems outside Konecranes. In other words, personal data is not used to develop or enhance AI systems belonging to third parties or suppliers.

Specifically, your personal data is used by us for the purposes set out below:

1. Pre-analysis of possible candidates;
2. Recruitment and talent management, including the management of related data and documentation;
3. Reporting and analytics;
4. Running, overseeing, maintaining, and carrying out research and development on our processes, IT services, and infrastructure;
5. Access management;
6. Organizing events
7. Distributing newsletters and communications covering job advertisements, company news, events for job applicants, and career stories
8. Keeping archives of inactive personal data for other purposes of use, following the defined retention rules;
9. Fulfilling the employer's rights and obligations, and/or defending them where necessary;
10. Safeguarding the integrity of the KC Group's business environment and processes, including system and security monitoring for preventing or investigating misuse where circumstances require it.

Where a specific job opening carries a predefined requirement (for example, education or skill), you may be automatically grouped according to that requirement. For example, candidates lacking a required level of education may automatically be removed from the recruitment process in question. Please note that this kind of categorization can carry significant consequences for you, since it could result in your exclusion from consideration for the job opening you have applied to.

For candidates applying for a position in China, the purposes for which your personal data is processed are as follows:

By using your personal data, we are able to ensure your job application is handled fairly and efficiently. Furthermore, should the recruitment process end favorably, the processing of your employee candidate data ultimately brings you economic benefits (e.g. salary), professional benefits (e.g. work experience and training), and social benefits (e.g. collegial interaction and co-operation).

At all times, you retain the right to:

• Rescind consent, where our processing of your personal data depends on consent having been given; and
• Object to our processing of your personal data where it is based on our legitimate interest;

In addition, you are entitled at any time to:

• Obtain access to your personal data;
• Confirm that your personal data is accurate;
• Request that any incomplete, inaccurate or outdated personal data concerning you be corrected, modified or deleted; and
• In certain situations, limit how your personal data is processed;
• In certain situations, request that we forget you;
• Receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and transmit that data to another data controller where the processing relies on consent you have given to us; and
• File a complaint with a supervisory authority.

To exercise these rights, you may email us at data.protection(a)konecranes.com or complete the Contact Us form.

For candidates applying for a position in China, data subjects are additionally afforded the following legal rights under China's data protection laws:

In line with mandatory data protection law requirements, we have carried out a thorough assessment of the risks that our processing of Employee Candidate Data may pose to your rights and freedoms.

As is the case with any data processing, our processing likewise carries certain risks, primarily concerning

• how confidential your personal data remains;
• general matters of data security; and
• the possibility that you may be unable to access our systems and services.

That said, these risks have been assessed as low, with only a remote likelihood of occurring. We also take active steps to mitigate them, i.a. through:

• providing ongoing training to our data-processing and HR staff;
• supplying and continuously developing detailed instructions; and
• putting in place and continually improving our data security practices.

We gather your personal data:

• directly from you;
• from your earlier employer(s);
• from other Konecranes staff (e.g. HR support personnel); or
• from outside parties who assist with Konecranes' business processes, such as recruiters; and
• from public sources.

Yes, depending on circumstances we may transfer your personal data outside the EU/EEA, both within our group of companies and to external business partners that provide services to us.

Your personal data may be transferred for processing to the following countries:

To support our personal data processing, we engage reliable subcontractors that provide services such as IT or recruiting support to us - these services include, without limitation, the provision of various infrastructure, software and applications routinely used for contact data processing within global corporate groups.

Your data is not disclosed beyond our effective control, except where legally required, such as when a court, the police, or another law enforcement authority requests it from us.

Your data may also be shared, on a limited basis, with trusted business partners including banks, insurance companies, auditors, and legal advisors.

We safeguard your personal data through technical and organizational measures designed to prevent accidental and/or unlawful access, alteration, destruction, or other processing, including unauthorized disclosure or transfer of your personal data.

These measures include, without being limited to, adequate firewall arrangements, suitable encryption of communications and messages, and the use of secure, monitored equipment and server rooms. Data security receives particular attention when third parties (e.g. data processing subcontractors) are engaged to provide and implement IT systems and services.

We properly observe data security requirements when managing and monitoring access to IT systems. Staff who process your personal data as part of their duties receive training and appropriate instruction on data protection and data security matters.

For a maximum of twelve (12) months (the "General Retention Period"), counted from the:

1. The recruitment decision, where the application concerns a specific job opening; OR
2. The collection of your Employee Candidate Data, where the application is an open job application;

except where otherwise required or permitted by:

1. Any applicable legislation; OR
2. Your consent.

Retention of your Employee Candidate Data can in all cases be extended where necessary for establishing, exercising or defending legal claims, or for carrying out the Group's internal investigations, as circumstances may require.

Canada, Finland, Germany and the US are subject to exceptions to the above, as described here.

• In Canada, the General Retention Period does not apply; instead, all Employee Candidate Data, for all purposes of use, is retained for twenty-four (24) months, beginning with the Recruitment decision for a specific job opening, or with the collection of Employee Candidate Data for an open job application.
• In Finland, on top of the General Retention Period, Employee Candidate Data kept for the purpose of fulfilling employer duties and the rights of both employee candidates and the employer (including, among others, matters related to non-discrimination or criminal processes) is retained for twenty-four (24) months.
• In Germany, rather than the General Retention Period, all Employee Candidate Data, for all purposes of use, is retained for six (6) months, calculated from the Recruitment decision for a specific job opening, or from the collection of Employee Candidate Data for an open job application.
• In the United States, in place of the General Retention Period, all Employee Candidate Data, for all purposes of use, is retained for thirty-six (36) months, starting from the Recruitment decision for a specific job opening, or from the collection of Employee Candidate Data for an open job application.

Section applicable to candidates who apply for a position in China

Although you are not obligated to provide your personal data, doing so is required in order for the recruitment process to proceed and for you to potentially enter into an employment contract with us.