General Oshkosh Website Privacy Policy Addenda

Oshkosh – Additional US, EU/UK, and Brazil Notices

This document provides additional information for individuals residing in countries and U.S. states that have enacted privacy laws giving certain additional rights to residents of those jurisdictions. These countries include, but are not limited to, those in the European Economic Area (EEA), the United Kingdom, and Switzerland, as well as Brazil. 

Additional US Privacy Notice for California Consumers

This notice was last reviewed and updated as of January 1, 2025. 

If you are a consumer in CA, CT, CO, VA, or UT¹, this notice applies to our processing of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”). The provisions of this Notice prevail over any conflicting provisions in other section of our General Oshkosh Website Privacy Policy  (the “Policy”). We sell and share, and in the past 12 months have sold and shared, substantially all categories of personal information described in section 1 below to and with third parties as further described under “How Oshkosh may share the information Oshkosh collects” in the general Policy. However, we do not sell or share, and in the past 12 months have not sold or shared, personal information of individuals we know to be under 16 years of age.

¹Other states have signed legislation that will govern the processing of information. These states, and the effective date of this legislation, are as follows: (Florida and Oregon (July 1, 2024); Montana (Oct. 1, 2024); Iowa, Texas and Delaware (Jan. 1, 2025); Tennessee (July 1, 2025); and Indiana (Jan. 1, 2026).

1. Collection of Personal Information

We have collected the following categories of personal information within the last 12 months:
(a) Identifiers, such as real name, unique personal identifier, online identifier, IP address, email address, account name, or other similar identifiers. 
(b) Personal information described in Cal. Civ. Code § 1798.80(e), such as telephone number, employment, bank account number, credit card number, debit card number, or any other financial information. 
(c) Characteristics of protected classifications under California or federal law, such as age or gender.
(d) Commercial information, such as products or services purchased, obtained, or other purchasing or consuming histories or tendencies.
(e) Internet or other electronic network activity information, such as information regarding your interaction with any websites, applications, or devices associated with our business.
(f) Geolocation data when vehicle telematics are used in relation to a vehicle fleet, not a person.
(g) Audio information from calls placed with customer service centers which may be recorded, and electronic information in the form of Internet or other electronic network activity information as described above.
(h) Professional or employment-related information, such as your occupation.
(i) Inferences drawn from any of the information identified in this section to create a profile about you reflecting your preferences, in order to optimize your experience, consistent with our Privacy Policy. 

We collect these categories of personal information from you, your device, and third parties including your authorized representatives and our business partners, as further specified in “The types of information Oshkosh collects” and “How Oshkosh uses the information Oshkosh collects” in the general Policy. Please see these sections to learn more about the types of information we collect and how we collect them. We retain each category of personal information as described in section “Protection and storage of the information we collect ” in the general Policy. 

2. Purposes of Collection

For each of the above categories, we use the personal information for a variety of business purposes such as:
(a) Auditing and reporting relating to particular transactions and interactions, including online interactions you may have with us or others on our behalf, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance.
(b) Helping to ensure security and integrity.
(c) Debugging to identify and repair errors that impair existing intended functionality.
(d) Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us.
(e) Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, and other similar services.
(f) Providing advertising and marketing services.
(g) Undertaking internal research for technological development and demonstration.
(h) Undertaking activities to verify, maintain, improve, upgrade, or enhance the quality or safety of our services.

3. Disclosure of Personal Information

Within the last 12 months, we have disclosed substantially all categories of personal information for our business purposes as described in section 2 above. To learn more about the categories of third parties with whom we share such information, please see section “How Oshkosh may share the information Oshkosh collects ” in the general Policy. If you would like specific information about our service providers who have received your information, please contact us at [email protected] and we will provide that information to you.

4. Privacy Rights

Consumers in CA, CO, CT, VA, and UT  have certain rights with respect to the collection and use of their Personal Information. Those rights vary by state. You may have the following rights, in each case under the conditions and to the extent set out in applicable law:
(a) Right to know and access what personal information we have collected about you, including the specific pieces and categories of personal information we have collected about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.
(b) Right to delete personal information that we have collected from you. Please note that if you have requested a service that requires the use of your personal information, we may not be able to provide that service if you choose to delete your personal information.
(c) Right to correct inaccurate personal information that we maintain about you.
(d) Right to opt-out of the sale or sharing of personal information with third parties. Like many companies, we sell or share personal information, or process personal information for targeted advertising purposes. You can opt-out of targeted advertising by visiting the Digital Advertising Alliance website or the Network Advertising Initiative website. To learn more about how to opt-out of targeted advertising, please see section “What choices do I have ” in the general Policy. If you opt-out of the sale of your personal information, we will wait at least 12 months before asking you if we may sell or share your personal information.
(e) Right to consent to or limit the use or disclosure of sensitive personal information. You have the right to consent to the use of your Sensitive Personal information in CT, CO, VA and UT. CA consumers also have the right to instruct us to limit the use and disclosure of your sensitive personal information. However, we do not use or disclose sensitive personal information for purposes that, under applicable law, require us to support the right to limit the use or disclosure of sensitive personal information. 

You may request to exercise these rights by:
(a) Calling us toll-free at 888-832-7797; or
(b) Completing our privacy rights request form available here: https://www.oshkoshcorp.com/contact-us. 

Additionally, we process opt-out preference signals from Global Privacy Control (“GPC”) as described in the “What choices do I have?” section of our general Policy . California consumers can also consult FAQs published by the California Privacy Protection Agency (CPPA) about how you can set up and use opt-out preference signals such as “Global Privacy Control” (see the FAQ titled “How to submit your requests).

As required under applicable law, we will take steps to verify your identity before granting you access to information or acting on your request to exercise your rights. We may require you to provide your first name, last name, and email address to verify your identity in response to exercising requests to know, delete, or correct. We may limit our response to your exercise of the above rights as permitted under applicable law. When you submit a request to exercise your rights above, we will use the information you provide to process your request and to maintain a record of your request and our response, as permitted under applicable law.

Under California law, you may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. We will require the agent to provide proof of that written permission. To the extent permitted by law, we may require you to verify your own identity in response to a request, even if you choose to use an agent. If you are an authorized agent submitting a request on behalf of a California consumer, please email us at [email protected]

You also have the right not to receive discriminatory treatment by us for the exercise of privacy rights.
 
If your rights request is denied, applicable law may give you a right to lodge an appeal with us. The response to your rights request will inform you of any appeal rights you may have and tell you how you can exercise them.

5. Additional California Information

Within the meaning of California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), we do not disclose personal information to third parties for their own direct marketing purposes. For additional practices, visit the section “Do Not Track” in the general Policy.   

6. Changes to this Notice

Oshkosh reserves the right to amend this Notice at our discretion and at any time. Learn more by reviewing the “Changes to this Privacy Policy” section in the general Policy.

If you would like additional information regarding this Notice, please contact us at  [email protected], visit our website’s Contact Us page, or call 888-832-7797.

Additional GDPR Privacy Notice

This supplemental Notice applies to people who are located in the European Economic Area (“EEA”), Switzerland or the United Kingdom (“UK”) and is intended to be read in conjunction with our general Privacy Policy (the “Policy”). The definitions found in the Policy apply to this Notice.   

This notice was last reviewed and updated as of January 1, 2025. 

If you are located in the EEA, Switzerland, or the UK, in accordance with the European Union’s General Data Protection Regulation (the “GDPR”) and the UK Data Protection Act of 2018, which incorporates the GDPR as the UK GDPR (collectively, the “GDPR”), this Notice (together with other relevant sections of the general Policy) provides information about the collection, use, processing, and sharing of data about you.

Oshkosh is the responsible data controller for the purposes of personal data processed through this website. For our contact information, please see “Contact Us” in the general Policy.

Purposes and Legal Basis for Processing 

The legal bases for Oshkosh’s processing activities include processing such information as necessary to comply with our contractual obligations, compliance with our legal obligations, protecting the safety of our employees, customers, and others, for our legitimate business interests, and pursuant to your consent. The particular legal basis for the processing of your personal data is based on the purpose for which such information was provided or collected as detailed in the table below:

Your decision to provide personal data to Oshkosh is typically voluntary, except where personal data is, for example collected to meet a legal requirement or necessary in connection with a contract we have with you.

If you do not provide certain personal data, we may not be able to achieve some of the purposes outlined in this Notice or our general Policy.

Rights of Data Subjects

You have the right to request access to your personal data, to have your personal data corrected, restricted or erased, to revoke any consent that you have given to the processing of your personal data (without affecting the lawfulness of the processing prior to revoking your consent) and to object to our processing of your personal data in certain circumstances. You also have the right to take your personal data away (data portability) in certain circumstances, which means that you can request that we provide you (or a third party you designate) with a transferable copy of personal data that you have provided to us. Your rights may be subject to various limitations under the GDPR. If you wish to exercise any of these rights, or if you have any concerns about our processing of your personal data, please contact us in any of the ways listed in the section “Contact Us” in our general Policy.

You have the right to file a complaint concerning our processing of your personal data with your local data protection authority. The EU Commission has a list here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm. You may also contact the UK Information Commissioner’s Office (www.ico.org.uk) or Switzerland Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/task.html) as appropriate.

Additional Privacy Notice for Brazilian Residents

This supplemental Notice applies to people who are located in Brazil and is intended to be read in conjunction with our general Privacy Policy  (the “Policy”). The definitions found in the Policy apply to this Notice.

This notice was last reviewed and updated as of January 1, 2025

If you are located in Brazil, pursuant to Federal Law No. 13,709/2018 – General Data Protection Law of Brazil (“LGPD”), this Notice (together with other relevant sections of the general Policy) provides information about the collection, use, processing, and sharing of personal data about you.

Oshkosh is the responsible data controller for the purposes of personal data processed through this website. For our contact information, please see “Contact Us” in the general Policy.

Collection, Use and Sharing of Personal Data

The legal bases for Oshkosh’s processing activities include processing such information as necessary to comply with our contractual obligations to you, compliance with our legal or regulatory obligations, protecting the safety of our employees, customers, and others, for our legitimate business interests, and pursuant to your consent. Legitimate business interests may include (1) to communicate with you in response to your requests, questions, inquiries, and submissions; (2) to protect against fraud, harassment, intellectual property infringement, crime and security risks; (3) to conduct advertising and marketing in connection with operating our business; and (4) for research and development, security and optimization of our products and websites. For additional business uses, please refer to “How Oshkosh uses the information Oshkosh collects” in the general Policy.

We also may share your personal data with our service providers, who are required to protect it by law or contract and use it in accordance with our instructions.

Automated Decisions

Oshkosh uses attributes in your Online Express (“OLE”) user profile to personalize your experience on the site, including, but not limited to, translating the site content into Portuguese. Please not that, in this regard, you have the right to request for the review of decisions made solely based on automated processing of personal data affecting your interests, including decisions intended to define your personal, professional, consumer and credit profile, or aspects of your personality. 

Rights of Data Subjects

LGPD provides certain rights to individuals with regard to their personal data where Oshkosh acts as a data controller with respect to the custody and processing of your information. Pursuant to the LGPD, you have the right to submit requests based on the following rights:

1. confirmation of processing;
2. access to your data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of unnecessary or excessive data processed in violation of the LGPD;
5. deletion of data processed with your consent;
6. portability of your data to another service or product provider, upon express request, as provided by applicable law;
7. information about the public and private entities with which we shared data;
8. information about the possibility to refuse providing consent to a personal data processing activity and to be informed about the respective consequences, when applicable; and
9. withdrawal of your consent.

If you wish to exercise any of these rights, or learn more about these rights, please contact us in any of the ways listed in the section “Contact Us” in our general Policy. We may need to verify your identity before we process your request.

Please note that your rights may be subject to various limitations under the LGPD. For instance, your request may be legally rejected if you are unable to verify your identity or when you request deletion of data that is required or permitted under applicable law to be maintained. In the event that Oshkosh is unable to comply with your request, we will let you know the reasons why the request cannot be fulfilled.

If you believe that we are processing your personal data in violation of applicable law, you may also file a complaint with Oshkosh’s Data Protection Officer, Victor Furlan (Controller), who may be contacted at [email protected], or with a supervisory authority.

Language

The Policy may have been prepared in the English language and in the Portuguese language. If you are a user located in Brazil, you shall refer to the Portuguese version, which shall prevail.