Collection, Use and Deletion of Personal Data

As part of our privacy commitment at Johnson Controls, we incorporate stringent data collection and management policies into everything we do to protect our employees, partners and customers. The protection of personal data is our top priority. Our customers can feel confident about the data collection and privacy practices whether on site, through the cloud or using our AI-infused service solutions. We apply appropriate technical, physical and organizational measures that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access and against other unlawful forms of processing.

We collect different categories of personal data to allow us to do business and provide a service and for other reasons which are set out in detail in our Privacy Notice.

Our legal basis for processing personal data includes:

• The performance of a contract with our customers and suppliers.
• The legitimate interests of Johnson Controls, which are our usual business activities. 
• Compliance with our legal obligations under applicable law. 
• Consent, where required, and to the extent of applicable law. 
• To protect the vital interests of a person, where required, and to the extent of applicable law.

Access to personal data is restricted to authorized recipients on a need-to-know basis. We maintain a comprehensive information security program that is proportionate to the risks associated with the processing.

If you would like to exercise any of your rights, please refer to our privacy request portal for further information about how you can make a request. You may also contact our Global Privacy Office at www.johnsoncontrols.com/contact-us.