“BOOTS ON GROUND” APPLICATION

The Holcim Group Affiliate operating in the country where you are located (hereinafter individually referred to as the “Controller”, “Us” or “We” ), acting as your employer, is the data controller responsible for the processing of your personal data you provide while using the “Boots on Ground” application (hereinafter the “BoG App”). Holcim Global Digital Hub (hereinafter “GDH”), 17th Floor C & D Wing, Empire Tower, Airoli, Navi Mumbai- 400708, India acting as developer of the BoG App is the data processor of your personal data you provide in the BoG App.

We are committed to protecting your personal data and being transparent about the manner your personal data are being processed while you use the BoG App. We take utmost care to process your personal data in accordance with the principles set forth in the data protection legislation applicable in the countries where Holcim Group operates, including (EU) Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR").

This Privacy Policy regards the personal data of the employees and workers of the Controller, who were granted access to use the BoG App.

This Privacy Policy describes:

the purposes for which we collect and use your personal data;
the processing grounds for such purposes;
the categories of personal data we collect from you and process and the sources from which they originate;
whether the provision of your personal data is necessary and the possible consequences of your refusal to provide such data;
to whom we disclose or we may disclose your personal data;
the countries where we transfer your personal data;
the duration of processing of such data;
your rights as data subject and the way you may exercise them.

PURPOSES, GROUNDS FOR PROCESSING AND CATEGORIES OF PERSONAL DATA

In the context of your interaction with the BoG App We use your personal data in the following cases:

Activity

Purposes

Categories of personal data and sources

Grounds for processing

Health Safety & Environmental compliance

We process your personal data for managing your employment or other type of relationship with us, for the following main purposes:

organizational compliance, in particular monitoring and assessing compliance with our Health, Safety & Environmental (HSE) policies and standards (e.g., implementing an internal reporting tool through BoG App for relevant employees which enables reporting of unsafe working conditions, actual/ potential hazards, actual/ suspected H&S misconduct, perform Visible Personal Commitments observation in the BoG App, conducting HSE observation tours, recording the findings and proposing improvements)
regulatory compliance, ensuring compliance with our HSE legal and regulatory obligations and requests anywhere in the world, including reporting to or being audited by national and international regulatory, enforcement or exchange bodies which may include conducting due diligence as required under applicable law and regulations;
disputes and enforcement of claims, including supporting us in dealing with and solving disputes, complying with orders of courts, authorities or other public bodies, enforcing our contractual agreements and to establish, exercise or defend legal claims.

forename, middle name(s) and surname, email, other data you may provide directly through the BoG App.

The app has a functionality to validate and confirm whether the user is present at the Zone where he is performing the BoG tour. To achieve this, the mobile app captures the current latitude and longitude of the user's device and compares it with the latitude and longitude of the Zone, Area and scanned tag (QR location).This happens while the app is in use and the location of the user is not stored by the App in the system.

The App also captures user data available from Google Directory, such as N+1 as well as mobile number, in order to enable approval workflows and facilitate communication among users.

For users of the SHIELD module, in addition to the above, the app requests access to the mobile device’s Health data (move: step and stairs count) and to microphone (to process and evaluate the noise level) .

The step and stair count is used to calculate the calories burned during the field tour.

These features are optional and the user can decline them, as they do not affect the intended scope of the App.

When good or excellent work or good practices are identified, the user is required to register the name of the employee recognized. This is captured to facilitate the Reward & Recognition program.

Depending on the jurisdiction and the specific purpose, the processing is either necessary:

for the performance of your agreement with Us,
for compliance with a legal obligations incumbent to Us or
for achieving our legitimate interests.

Our legitimate interests consist of managing our workforce and operating our business, for instance, undertaking normal business operations and maintaining a dialogue with our employees, contractors and workers, ensuring that each employee, contractor and worker undertakes appropriate duties, is properly trained and undertakes its role correctly and in accordance with appropriate procedures.

In case some of the personal data have a special regime under the data protection laws, we will process such data to the extent one or more of the guarantees prescribed by the law for processing such data are applicable.

Changes in structure or similar transactions involving the Controller

We may also process your data in the context of changes in structure or similar transactions involving Us.

forename, middle name(s) and surname, email, other data you may provide directly through the BoG App.

In this case, the grounds for processing may be represented by:

the legal obligation (in case We are legally obliged to disclose certain personal data to public authorities);

the performance of the agreement concluded by Us in the context of such transaction or our legitimate interest to carry out the transaction in the most effective manner.

PROVISION OF PERSONAL DATA

When We request you to provide Us your personal data in the BoG App, We kindly ask you to provide all categories of personal data We request. You will be free to refuse the provision of your personal data, however if you do withhold specific data We shall not be able to achieve the processing purposes described above without processing such data.

DISCLOSURE OF YOUR PERSONAL DATA

To achieve the aforementioned purposes and to the extent necessary, We disclose or we may disclose your personal data provided in or through the BoG App to the following categories of data recipients:

other companies that are part of the Holcim Group;
central/local public authorities, government agencies, governmental providers of healthcare services, social security authorities and other authorities;
providers of IT support services, storage and hosting services;
agents, consultants, contractors and other third parties that provide services to Us;
other contractual partners of Us to whom data should be disclosed so that they may provide the services covered by the relevant contracts;

We disclose your personal data to the above-mentioned data recipients:

if we are under an obligation or have permission to do so by law or in the context of legal proceedings, for instance to enforce a court ruling or to comply with a request made by a law enforcement agency;
if we deem that the disclosure is necessary or appropriate in order to prevent physical harm or financial loss;
in relation to an investigation into a fraudulent activity or other unlawful activity, actual or suspect;
if we sell or transfer our business or assets, entirely or partially (including in the event of a reorganization, winding-up or liquidation of business);
for other legitimate interests justified by Us.

TRANSFER OF YOUR PERSONAL DATA

We transfer or We may transfer your personal data to recipients located in other countries than the country where the personal data was originally collected. It is possible that such countries do not have the same data protection laws as the ones from the country where you have initially provided the personal data. In this case, we will implement appropriate guarantees, in accordance with the law, to your personal data irrespective of the countries to which they are transferred.

If you are a resident of the European Economic Area and the GDPR applies to you, or Switzerland, we may transfer your personal data to the following LafargeHolcim Affiliates:

LafargeHolcim Affiliate	Contact details of LafargeHolcim Affiliate
Holcim Ltd	Grafenauweg 10, 6300 Zug, Switzerland
Holcim Group Services Ltd	Grafenauweg 10, 6300 Zug, Switzerland
Holcim Technology Ltd	Im Schachen, Holderbank Aargau 5113 Switzerland
LafargeHolcim European Business Services	Protifašistických bojovníkov 11 040 01 Košice, Slovakia
LafargeHolcim IT EMEA	Albasanz 14 28037 Madrid, Spain
Holcim Services (South Asia) Limited	17th Floor, Phase I & II, Reliable Tech Park, Thane Belapur Road, Airoli, Navi Mumbai-400708 / India
LafargeHolcim Global Hub Services Private Limited	17th Floor, Phase I & II, Reliable Tech Park, Thane Belapur Road, Airoli, Navi Mumbai-400708 / India

DURATION OF THE PROCESSING

We will retain your personal data provided in the BoG App for as long as is reasonably necessary for the purposes explained in this Privacy Policy. For example, your personal data is retained during your relation with Us, and afterwards for a subsequent period necessary for ensuring compliance with the applicable law.

YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

If you are a resident of the European Economic Area and the GDPR applies to you, or if you are a resident of another country which enacted a data protection law that provides any of the below listed rights in your favor, you will enjoy the benefit of these rights.

Right of access	Allows you to obtain confirmation that your personal data are being processed by Us and, if affirmative, the relevant details of such processing activities, as well as a copy of your personal data.
Right to rectification	Allows you to rectify your personal data if inaccurate.
Right to erasure	Allows you to obtain the erasure of your personal data in certain cases (e.g., if the data are no longer necessary in relation to the purposes for which it was collected). Important! We will not be able to act on such requests in all cases, such as where the law compels us to keep data for a certain period, or where the data are necessary for a legitimate interest such as the defense of a right in court.
Right to restriction	Allows you to request Us not to use your personal data in any way except to store it until another request from you is resolved, namely: (i) you have requested the rectification of the data; (ii) you have opposed the erasure of the data in the case of unlawful processing; (iii) you have required us to provide you with certain data for the defense of a right; (iv) you have objected to the data processing.
Right to object	Allows you to object to further processing of your personal data within the conditions and limits set forth by law. Important! The law compels us to act on such requests only for direct marketing processing (e.g., if you receive emails with our informative notes, you can unsubscribe). In the other cases, we will balance our interests and your particular situation in order to make a final decision. Therefore, please explain why you object to the processing when making such a request.
Right to portability	Allows you to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another data controller. Important! The law compels us to act on such requests only for the data previously processed based on your consent or on the performance of the contract concluded with us and only if the processing is carried out by automated means.

You may exercise your aforementioned rights and find out more about the processing of your personal data by sending a request to privacyh@holcim.com

You also have the right to file a complaint with the competent data protection authority.

PREDICTIVE TECHNOLOGY DISCLAIMER

The predictive analytics and related features (hereinafter "Predictive Technology") provided through this application are intended to support human risk awareness and decision-making. While some efforts are made to identify patterns and potential hazards, this Predictive Technology does not offer accurate prediction, prevention, or avoidance of future incidents or events.

Users acknowledge and agree that:

Predictions are based on current and historical data, which may not reflect future conditions.
The Predictive Technology may not identify all risks, hazards, or outcomes. Further, the risks, hazards, or outcomes identified by the Predictive Technology may be faulty, incorrect, and misleading.
The detection of a potential incident does not ensure that the incident will be prevented.
Several factors are not considered as a part of the Predictive Technology. These factors may alter actual outcomes.
The user and the company using the results of the Predictive Technology acknowledge that they are responsible for making a full assessment (made by a human) of the potential risks, hazards, outcomes, and cannot rely on the Predictive Technology. The Holcim Group company making the application and Predictive Technology available cannot be held responsible or liable for the users' or the Holcim company's reliance on the Predictive Technology.

This Privacy Policy version entered into effect on 6th February 2025

Previous versions:

Version 1_June 2021
Version 2_June 2023

We may amend this Privacy Policy from time to time, for example, to keep it up to date or to comply with legal requirements or changes in the way we operate our business.

Page of

LafargeHolcim European Business Services

LafargeHolcim IT EMEA

Holcim Services (South Asia) Limited

LafargeHolcim Global Hub Services Private Limited