Privacy Notice for “MyAccount”

 

With this Privacy Notice (hereinafter the “Notice”), we inform you about the processing of your personal data when you register an account with us (hereinafter the “Account”) via our platform “MyAccount” and make use of the Account, including the participation in promotional campaigns. We also provide information about your rights in relation to your personal data.

For information concerning the processing of your personal data when visiting our website and the cookies in use, please see our website privacy notice available at http://uk.milwaukeetool.eu/footer/my-account-privacy-notice/ and our cookie policy available at https://uk.milwaukeetool.eu/footer/cookie-policy/.

 

I.Controller

For the purpose of applicable data protection laws, the data controller (within the meaning of Art. 4 No. 7 General Data Protection Regulation (“GDPR“), in other words, the organisation that determines how and for what purposes your personal data is used) will be one of Techtronic Industries EMEA Limited’s group companies and affiliates (in each case “TTI”, "we", "us", "our"), depending on the territory in which you are based.  For example, if you are a UK-based customer, then the controller of your personal data is Techtronic Industries UK Limited, whose registered address is at Suite A, Second Floor, Parkway, Marlow, Bucks, England, SL7 1YL England. Milwaukee Tool is a trading name of the members of the TTI corporate group.

We have included a list of territories and the relevant data controllers in section XI of this Notice.

 

II.Personal Data We Process

We process personal data within the meaning of Art. 4(1) GDPR that you provide or that we collect when you use the Account or participate in a campaign as set out in further detail below.

 

III.Source of Personal Data

We obtain personal data directly from you when you register, log in, manage your Account, set marketing preferences, or submit campaign registrations and claims. We also receive data from our authentication provider (SSO) to confirm account existence and verification status and from campaign service providers who help validate and process claims and redemption.

 

IV.How Do We Use Your Personal Data and What Are The Legal Bases?

We process your personal data for the following purposes, subject to the following legal bases:

 

1.Account Creation and Access to MyAccount

When you register your Account, we process personal data that are required to operate the Account under MyAccount. This includes the processing of required data consisting of your full name (first name, last name), e-mail address, trade, subtrade. The delivery address is only required if you participate in a campaign that requires the delivery address for shipment of any goods, otherwise it is optional. Further optional data are your mobile number and your date of birth.

 

Legal basis of the processing of the mandatory data, is the performance of the usage agreement based on Art. 6(1) lit. b GDPR. The processing of the optional data is based on your consent (Art. 6(1) lit. a GDPR).

 

2.Security Logs

We process certain security logs to the security and integrity of MyAccount and user accounts during the account creation process. This includes the detection, prevention, and investigation of unauthorized access attempts, fraudulent activities, or misuse of the registration system. This includes the IP address, timestamp of the registration attempt, the email address and username used, browser information, and log data.

Processing of such data is technically necessary in order to ensure the security of MyAccount. We may also store such security logs for a limited time in order to track and enforce any infringements.

Legal basis for the processing of your personal data is our legitimate interest pursuant to Art. 6(1) lit. f GDPR in maintaining the security and integrity of MyAccount and preventing abuse.

 

3.Auth0

We use the authentication service Auth0 to authenticate users. Auth0, acting as our processor, is provided by Auth0, Inc. and allows us to manage and store your sign-in credentials in relation to your Account as well as to any other accounts you might have registered with us. In order to be able to identify you, Auth0 processes your personal data such as your email address, IP address, device information, and your unique Auth0 ID.

The Auth0 ID will serve as your unique identifier and allows to authenticate you as user. Your personal data is processed solely for authentication purposes, ensuring account security, and preventing unauthorized access. The legal basis for processing is our legitimate interest in the secure and efficient provision of our services, especially to ensure that user authentication processes are secure and protected against unauthorized access, Art. 6 (1) lit (f) GDPR.

 

4.Newsletter; Marketing Communications

When you sign up for the newsletter, we process the data you enter to complete the registration process (full name, email address) and record your preferences and your consent.

Furthermore, we collect your personal data via so-called "web beacons". Web beacons contain information as to whether (i) our newsletter was delivered, (ii) it has been opened and (iii) any links contained in it have been clicked. Specifically, we receive statistical evaluations, allowing us to determine whether the newsletter was delivered and engaged with. This helps us to adapt and improve our newsletter service.

In order to provide our newsletter service, we use Salesforce. This includes processing of the aforementioned data on Saleforce‘s servers in the USA.

Where applicable, the registration for the newsletter takes place in the so-called double opt-in procedure. In such case, we will send you an email after your registration, asking you to confirm your registration. In order to prove the registration process according to the legal requirements, your application verification data (time of registration, your IP address) will be logged.

Legal basis for the provision of the newsletter and the processing of your data is your consent pursuant to Art. 6(1) lit. a GDPR. You can revoke your consent at any time via the unsubscribe link included in each newsletter email.

 

5.Participation in Promotional Campaigns

We process your data to administer and operate any promotional campaigns that we may run from time to time, for example a product redemption campaign where we will need to process your connected claim(s). We will inform you about the processing of your personal data by way of separate privacy notices applicable to the relevant campaign.

 

6.Contacting us

If you decide to contact us via our contact form https://uk.milwaukeetool.eu/service/contact/, we will process the data provided by you for the purpose of processing your request as well as providing you with the requested information and contacting you for further assistance. Legal basis for the processing of your data by us is Art. 6(1) lit. f GDPR. We have a legitimate interest to process your data in order to properly respond to your request.

 

7.Analytics and Tools

 

a)Google Tag Manager

We use Google Tag Manager. Google Tag Manager is a tag management system (TMS) that allows us to update measurement codes and related code fragments (tags). T

The Google Tag Manager enables us to integrate these tags in MyAccount, as well as to determine the actions which should be recorded. If a tag is triggered by an action, the data collected by the tag is sent to the analysis or marketing services integrated via the Google Tag Manager. The Google Tag Manager itself does not create any user profiles and does not carry out any independent analyses.

In order to be able to monitor and provide diagnostics about system stability, performance, and installation quality, Google collects aggregated data to a certain extent relating to tag firing. According to Google’s information, the aggregated data do not contain any IP addresses or measurement IDs that are linked to a specific person. Additionally, Google Tag Manager collects data in the standard HTTP request logs. These are all deleted within 14 days of receipt.

We have also enabled the conversion linker in Google Tag Manager to support measurement of click data so that conversions can be recorded effectively. Specifically, information on click behaviour in relation to ads is recorded and stored.

The processing is carried out exclusively on the basis of Art. 6(1) lit. a) GDPR.

 

b)Google Analytics

We use Google Analytics to track the use of My and the functions and services provided and, from this, to identify which functions and services are of particular interest to users and how we can improve our services. The provider responsible for the operation of Google Analytics in the European region is Google Ireland Limited, Google Building Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland.

During your visit to the website, your user behaviour is recorded in the form of “events”. Events can be: page views, first visit of MyAccount, start of the session, your “click path”, interaction with the Account, scrolls (whenever a user scrolls to the bottom of the page (90%)), clicks on external links, internal search queries, interaction with videos, file downloads, adverts viewed/clicked, language setting. The following data is also recorded: your approximate location (region), your IP address (in abbreviated form), technical information about your browser and the end devices you use (e.g. language setting, screen resolution, device model), the referrer URL. An individual ID for the end device is also recorded. This is the Android Advertising ID or Advertising Identifier for iOS (if activated) or another individual ID (Vendor Identifier).

Google Analytics uses cookies which enable your use of MyAccount to be analysed. Information collected by the cookie about your use of MyAccount is usually transmitted to a Google server in the US and stored there. These servers are operated by Google LLC. Google Analytics has activated IP address anonymisation by default. Using IP address anonymisation, your IP address is shortened by Google within member states of the EU or in other contracting states of the Agreement on the European Economic Area (EEA). Only in exceptional circumstances will the full IP address be transferred to a Google server in the US and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Google processes the above information in order to analyse your usage behaviour and to compile reports on website activity on our behalf. The reports provided to us by Google Analytics are used to analyse the performance of MyAccount. On this basis, we are able to continuously improve individual functions and services and adapt them to the needs of our users. The data collected and linked to the cookies set by Google Analytics is automatically deleted after the specified retention period has expired. Data for which the retention period has expired will be automatically deleted once per month.

 

The use of the service is based on your consent. The legal basis for the processing of personal data in connection with the use of Google Analytics is Article 6(1) lit a GDPR. You can revoke your consent at any time by deactivating the use of the service in the “Cookie settings”. In addition, you may prevent the collection by Google of data generated by the cookie relating to your use of MyAccount (including your IP address), and the processing of this data by Google, by downloading and installing the browser add-on provided by Google for deactivating Google Analytics:

•  

Further information about Google’s privacy terms is available here:

•  

c)Dynatrace

We use the Dynatrace monitoring tools, provided by Dynatrace, Inc., to monitor performance and stability, troubleshoot errors, and understand how the Account is used so we can improve reliability and user experience.

Dynatrace may collect performance and diagnostics data such as device and browser type, operating system, page URLs and referrers, click/touch events, timestamps, session identifiers, and IP address used to derive approximate location.

To the extent processing is strictly necessary for the provision of the Services (e.g., essential error logging and security), it is based on our legitimate interests in operating a secure and stable service (Art. 6(1) lit. f GDPR).

 

8.Group Internal Data Transfers

Our group shares various operations and business processes. We may share your personal data with any member of our group based on our legitimate interests (Art. 6(1) lit. f GDPR) in providing the Account and relates services to you and to carry out the processing activities mentioned in this Notice or to provide you with a satisfying user support, for which we ensure that you will have a local contact person in your region. To do so may transfer your account-related data to the respective local entity, which will assist you locally. Depending on the action carried out the local entity will either act as our processor or as controller.

 

V.HOW DO WE SHARE YOUR PERSONAL DATA?

This includes external service providers who support us in connection with the provision of the Account and its content. Your personal data is processed by external service providers exclusively on our behalf and in accordance with our instructions. These recipients are so-called processors (see Article 4 No. 8 GDPR). Your personal data is also transmitted to recipients who process your personal data under their own responsibility (see Article 4 No. 7 GDPR).

We transmit your personal data to the following recipients:

• Technical service provider (regarding hosting of MyAccount and provision of support and security services for MyAccount)
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Google (regarding use of Google Analytics, Google Tag Manager)
• Dynatrace, Inc. (regarding the use of Dynatrace’ services as set out in IV.7.d)).
• Authentication and SSO provider (Auth0/Okta) for account and password management.
• Salesforce for preference management, double opt-in workflows, and communications.
• Campaign operations and claim processing partners: Bubble House and local market/agency partners who validate proof of purchase, process claims, and administer redemption as well as logistics partners regarding the shipment of the rewarded product
• Other TTI group companies as set out in section IV.8.

Where we engage processors, they may only process personal data on our documented instructions and are subject to appropriate confidentiality and security obligations

 

VI.International Data Transfers

We are based in the EEA / UK and collect and process your personal data there to the extent necessary. We may onward transfer your data in the cases set out in the previous section of this Notice.

Where we onward transfer your personal data out of the EEA, the transfer will be based on a data transfer mechanism under Art 44 et seq. GDPR. A transfer to a third country will only take place in compliance with the applicable data protection regulations, in particular the guarantee of an adequate level of data protection.

 

VII.How long We Keep Your Personal Data

We will only retain your personal data for as long as is necessary for the purposes described in this Notice. We will also retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We have a retention policy in place which we keep under review taking into account our reasons for processing your personal data and the legal basis for doing so.

 

VIII.Obligation to Provide Personal Data

You are not legally required to provide personal data to use the Account. However, certain information is necessary to create and operate your Account, enable authentication and security features, manage your preferences, and participate in campaigns. If you do not provide required basic personal contact data required for account creation, we will be unable to create and provide the Account and specific features.

 

IX.Your Rights

You have the following rights vis-à-vis us with regard to your personal data:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR).

Where we process your personal data on the basis of your consent, you have the right to withdraw your consent pursuant to Art. 7 (3) GDPR. Please note that your withdrawal only takes effect for the future.

As far as your personal data is processed for the purpose of our legitimate interest pursuant to Art. 6(1) lit. f GDPR, you have the right to right to object to the processing according to Art. 21 GDPR. You can find further information on your right to object in accordance with Art. 21 GDPR below.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) about the processing of your personal data by us.

Information about your right to object in accordance with Art. 21 General Data Protection Regulation (GDPR) You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you on the basis of Art. 6(1) lit. f GDPR (processing of personal Data based on a balancing of interests); this includes profiling based on those provisions (Art. 4 No. 4 GDPR). Should you decide to object the processing, we will stop processing personal data concerning you, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the purpose of establishment, exercise or defense of legal claims. You also have the right to object at any time to processing of personal data concerning you for the purpose of advertising; this also applies to profiling insofar as it is associated with advertising (if any). Should you decide to object to the processing for advertising purposes, we will stop to process personal data concerning you for these purposes. The objection is not subject to any particular form. Ideally, it should be lodged by the contact method mentioned in Section I.

 

In order to exercise the aforementioned rights, you can contact the bodies mentioned in Section I.

 

X.Changes to this Privacy Notice

We may update our privacy notice from time to time. Any changes we may make to our privacy notice in the future will be posted on this site. We may also email you if we have your email address. Please check back frequently to see any updates or changes to our privacy notice.

This Notice was last updated on 28 January 2026.

 

XI.Data Controllers and their Contact Details

If you have any questions regarding this Notice, your rights or are unsure which data controller is responsible for your data, please contact our Data Information Manager:

For UK: Techtronic Industries EMEA Ltd, 22 Market Street, Maidenhead, SL6 8AD England;

For EEA/EU: Techtronic Industries ELC GmbH, Max-Eyth-Str. 10, 71364 Winnenden, Germany;

You can also reach out to us via the following link: Privacy Web Form (onetrust.com).

 

Territory	Data Controller	Registered Address	Contact Details
Belgium, the Netherlands, Luxembourg	Techtronic Industries Benelux B.V	Laan van Europa 450, 3317 DB Dordrecht, Netherlands	Tel: xxxxx Email: Privacy Web Form (onetrust.com)
Austria, Germany Switzerland	Techtronic Industries Central Europe GmbH	Walder Strasse 53, 40724 Hilden, Germany	Tel: +49 2103 960 0 Email: Privacy Web Form (onetrust.com)
Poland, Hungary, Slovakia, Czech Republic, Romania	Techtronic Industries Eastern Europe SP Z.o.o	Komitetu Obrony Robotników 45A, 02-146 Warszawa, Poland	Tel: +48 242 424 004 Email: Privacy Web Form (onetrust.com)
Croatia, Bulgaria, Slovenia	Techtronic Industries South-East Europe D.O.O	Buzinski krči 7 (object mark B2_4), Odra, HR 10010 Zagreb Croatia	Tel: xxxxx Email: Privacy Web Form (onetrust.com)
France	Techtronic Industries France S.A.S	35 rue de Guivry, 77990, Le Mesnil-Amelot, France	Tel: +33160946970 Email: Privacy Web Form (onetrust.com)
Spain, Portugal	Techtronic Industries Iberia S.L.	Avenida de Fuentemar 20, 1º E, Coslada, Madrid, Spain	Tel: +34 91 627 9228 Email: Privacy Web Form (onetrust.com)
Italy	Techtronic Industries Italia s.r.l.	Via G Matteotti 62 20092, Cinisello Baslsamo, Milan, Italy	Tel: xxxxx Email: Privacy Web Form (onetrust.com)
UK, Ireland	Techtronic Industries UK Limited	Suite A, Second Floor, Marlow International, Parkway, Marlow, SL7 1YL, UK	Tel: 01628 894400 Email: Privacy Web Form (onetrust.com)
Denmark, Finland, Norway, Sweden, Latvia, Lithuania, Estonia	Techtronic Industries Nordics Aps	Stamholmen 147, 1., DK-2650 Hvidovre, Denmark,	Tel: +45 43 56 55 55 Email: Privacy Web Form (onetrust.com)