Global Directory

1. Our commitment to privacy

Johnson Controls cares about your privacy and is committed to protecting your personal information in accordance with fair information practices and applicable data privacy laws. At Johnson Controls “Integrity First” is one of our core values. We operate with integrity at all times which means we design our products in an ethical way and not only to be legally compliant. Johnson Controls operates a rigorous Global Privacy Program, supported by our best-in-class Privacy Program Framework and our Binding Corporate Rules, which are designed to provide adequate global protection for data and personal information. The Johnson Controls Global Privacy Office is led by the Chief Privacy Officer, and supported by Global Privacy Counsel, Global Privacy Professionals, Global Privacy Champions, analysts, and support staff. The Johnson Controls Privacy Program is designed with the most stringent global privacy and data protection laws in mind.

Our commitment to the protection of your privacy is at the forefront of our business operations. We collect personal information in a variety of ways through normal business activities to enable us to deliver our products and services. This Privacy Notice explains how we protect your personal information and how we collect, use and share that information.

For further information (including product-specific privacy information), please refer to our Privacy which contains more information about our philosophy and experience, along with additional useful privacy resources.

2. Who is responsible for processing your personal information?

This Privacy Notice applies where Johnson Controls processes personal information as a ‘data controller.’ These are instances where we decide the purpose for which (i.e. why) personal information is processed.

This Notice does not apply where we process personal information as a ‘data processor’, which is where we process personal information on behalf of a customer. Where Johnson Controls is a data processor, we process personal information in accordance with the Johnson Controls Data Processing Addendum (unless we have agreed otherwise with a customer in writing), and we are not responsible for the privacy practices of our customers, which may differ from those described in this Privacy Notice. In these circumstances the customer should be contacted directly for further details of how your personal information is handled.

Please be aware that we are a global organization with offices in multiple locations around the world. To help you to determine which specific Johnson Controls entity is responsible for the processing of your personal information, you can ask your Johnson Controls business contact, consult the list of our locations on the Johnson Controls public website (www.johnsoncontrols.com) or contact us using the methods provided in the Contact Us section.

3. What is personal information and which types do we collect?

“Personal information” is any information which may directly or indirectly be used to identify you. This could include, for example, your name, address, telephone number, financial information, or employment information.

We collect the following types of personal information:

• Contact Information: This is personal information which allows us to communicate with you. For example, your name, address, postal code, telephone number, email address, username and social media account details.  
• Transactional Information: This is personal information which allows us to do business with you or to provide our services to you. For example, your purchases, enquiries, customer account information, order and contract information, delivery details, billing, credit card and financial data, details for taxes, transaction and correspondence history.
• Relationship Information: This is personal information which allows us to tailor our service to you or to provide you with a personalized experience. For example, your product and service preferences, preferred language, geographical location, marketing and advertising preferences.
• Security and Compliance Information: This is personal information which allows us to provide a safe and secure service. For example, credit checks, identification verification, background checks, visual or biometric recordings.  
• Product Information and Identifiers: Our products may collect system and event information relating to their setup, configuration and operation. For example, sensor data, equipment data, data regarding building spaces, energy usage data, fault data, event data, environmental data and other internal or external data, as well as product usage information and product personal data. In some circumstances, depending on the product, this may include video and audio signals.

We may also collect information such as your IP address via cookies or similar technologies.

What special category data do we collect?

Special category data is personal information about you which is more sensitive in nature and therefore it is often accorded additional protection under data protection law. This can include information which reveals your racial or ethnic origin, political opinions, religious or philosophical belief, genetic or biometric data, data concerning your health or sexual orientation.

The types of special category information that Johnson Controls may collect includes the following:

• Biometric Data: Some of our products use biometric technologies such as facial recognition technology or fingerprinting technology to provide certain product functionality. On occasion we may therefore collect certain biometric information such as facial photographs or facial, finger or eye recognition data.

We collect this special category data with your consent, if required by law, and we take steps to protect and limit any use of it to the purposes for which it is provided to us.

4. What purposes do we use this personal information for?

We only collect and process your personal information (including, where legally permissible, special category personal information) for the purposes listed below. Where we are required by law, we will obtain your prior consent to use and process your personal information for the following purposes. Otherwise, we will rely on another permitted legal basis (including, but not limited to, our performance of a contract, our legitimate business interests or such other legal basis which is applicable to the particular processing).

• Providing our products or services to you and managing our contractual obligations and your ongoing relationship with us: We may require your personal information to deliver our service or product to you or to provide you with customer support (such as managing your account, billing management, helpdesk support, providing product or safety related notices or such other support as is required in relation to our products or services).
• Tailoring our services to your preferences: We may use your personal information to provide you with a personalised service or content, to deliver adverts which may be of particular interest or to provide you with special offers and promotions.
• Improvement of our products and services: We may need to improve and develop our products. From time to time, we may need to process your personal information to carry out product innovation and testing, analytics, market research and development. 
• Maintaining secure and safe services and products: We may need to process your personal information to preserve and maintain the security of our websites, networks, systems and premises including protection against fraud and malicious security threats. 
• Financial screening: We may need to process your financial information for security verification purposes such as screening for anti-money laundering, screening sanctions lists or other similar verification lists.
• Fulfilling our business obligations: We may need to process your personal information to allow us to carry out order management, payment processing, contract management, financial management and website and service administration.
• Managing our supply chain and business network: In order to provide our products and services to you, we may need to process your personal information in connection with the utilisation of our third-party partner business network.  
• Corporate activity, including mergers, acquisitions and joint ventures: We may need to process your personal information in connection with certain corporate activity, such as a party acquiring all or part of the equity or assets of Johnson Controls or its business operations in the event of a sale, merger, liquidation, dissolution, or other.
• To comply with our legal obligations: We may need to process your personal information for purposes which are required by applicable law.

5. Johnson Controls products provided by your organization

We provide many of our products and services to organizations and businesses. If your organization provides you with access to one of our products or services, your use of the products or services will be subject to the terms and policies of your organization. Our processing of your personal information in connection with that product or service will be governed by a contract between Johnson Controls and your organization. If you have any questions about our processing of your personal information in connection with the products or services provided to your organization, please contact your organization for further information. You may also contact Johnson Controls directly with any specific questions about our business operations in connection with your organization. Please see the Contact Us section on our website for details.

6. Product Specific Information

Johnson Controls offers a range of products to customers [including our suite of OpenBlue products, such as Enterprise Manager, Active Responder and Companion]. Further privacy information about specific products can be found in our Product Privacy Sheets. These Privacy Sheets include further details of the data flows, categories of personal information processed, sub-processors, retention periods and data transfers.

7. Recipients of Personal Information

• Third Parties: We may use third parties to provide or perform services and functions on our behalf. We may make personal information available to these third parties, to perform these services and functions. Any processing of that personal information will be on our instructions and compatible with the original purposes.
• As Required by Law: We may also make personal information concerning individuals available to public or judicial authorities, law enforcement personnel and agencies as required by law, including to meet national security or law enforcement requirements, and including to agencies and courts in the countries where your information is stored, which may be outside your home country. Where permitted by law, we may also disclose such information to third parties (including legal counsel) when necessary for the establishment, exercise or defense of legal claims or to otherwise enforce our rights, protect our property or the rights, property or safety of others, or as needed to support external audit, compliance and corporate governance functions.
• Corporate activity, including mergers, acquisitions and joint ventures: Personal information may be transferred to a party (and its professional advisers) acquiring all or part of the equity or assets of Johnson Controls or its business operations in the event of a sale, merger, liquidation, dissolution, or other.
• Affiliates: We may also transfer and share such information to Johnson Controls affiliates in compliance with applicable law.

8. International Transfers

We are a global organization with offices in multiple locations around the world. This means we may transfer your personal information to Johnson Controls in the United States, to any Johnson Controls entity worldwide, or to third parties and business partners who are located in various countries around the world. The global nature of our organization means your personal information may be sent to countries in which standards of privacy protection differ from the standards of your country of residence. We have implemented measures to safeguard your personal information should it be transferred to another country, which include the following:

• Standard Contractual Clauses: We use contracts, such as the Standard Contractual Clauses published by the European Commission, to help protect your personal information when it is transferred outside Europe.
• Binding Corporate Rules: As a sign of our commitment to privacy, we have adopted a set of Binding Corporate Rules (“BCRs”). These contain our global privacy commitments, including our policy on transfers of personal information and associated individual privacy rights, with the aim of ensuring that your personal information is protected while processed by our affiliates around the world. These BCRs have been approved by the European Data Protection Authorities. You can consult our BCRs on our Privacy.
• EU-US Privacy Shield: Johnson Controls was and continues to be certified under the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework. Although the Privacy Shield Framework has been invalidated by the Court of Justice of the European Union (CJEU), Johnson Controls will continue to maintain its certification for the foreseeable future, until a replacement framework is created.  
• APEC Cross Border Privacy Rules System (“CBPR”): Johnson Controls privacy practices, described in this Privacy Notice, comply with the APEC Cross Border Privacy Rules System. The APEC CBPR system provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework can be found here. Click here to view our APEC CBPR certification status.

If you are in Japan, please be aware that we may jointly use and share your personal information within the Johnson Controls group to the extent needed for the purposes set out in this Privacy Notice.  Johnson Controls K.K. and Hitachi-Johnson Controls Air Conditioning, Inc. are responsible for the management of the personal information that is jointly used.

• Data Privacy Framework Program: Johnson Controls, Inc. and the affiliates and subsidiaries identified below comply with the EU-US Data Privacy Framework (EU-US DPF), UK Extension to the EU-US DPF and the Swiss-US Data Privacy Framework (Swiss-US DPF) (together, the Data Privacy Framework Program) as set forth by the US Department of Commerce. Johnson Controls has certified to the US Department of Commerce that it adheres to the principles set out in the Data Privacy Framework Program in respect of with regard to the processing (including onward transfers) of personal data received from the European Union, the United Kingdom (and Gibraltar) and/or Switzerland. If there is any conflict between the terms in this Privacy Notice and the principles in the Data Privacy Framework Program, the applicable provisions of the principles shall govern.

To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/ and to view our certification https://www.dataprivacyframework.gov/s/participant-search. 

In compliance with the EU-US Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (DPF), Johnson Controls, Inc. and the affiliates and subsidiaries identified below commit to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Johnson Controls, Inc. at: privacy@jci.com.

In compliance with the Data Privacy Framework Program, Johnson Controls commits to refer unresolved complaints concerning our handling of personal data received in reliance on the DPFs to TrustArc (https://trustarc.com/data-privacy-framework/), an alternative dispute resolution provider based in the United States. 

If you do not receive timely acknowledgment of your Data Privacy Framework Program related complaint from us, or if we have not addressed such a complaint to your satisfaction, please visit TrustArc for more information or to file a complaint: https://feedback-form.truste.com/watchdog/request. The services of TrustArc are provided at no cost to you. There may also be circumstances where you may invoke binding arbitration (as further set out in the Data Privacy Framework Program).

The Johnson Controls affiliates and subsidiaries certified under the Data Privacy Framework Program are:

• Johnson Controls APS Productions, Inc.
• Sensormatic Electronics LLC
• Exacq Technologies, Inc.
• Tyco Fire Products, LP
• ShopperTrak RCT Corporation
• WillFire HC, LLC
• York International Corp
• Johnson Controls Security Solutions LLC

The Federal Trade Commission has jurisdiction over our compliance with the Data Privacy Framework Program.

9. How do we protect your personal information?

We apply appropriate technical, physical and organizational measures that are reasonably designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and against other unlawful forms of processing. For more information on Johnson Controls’ Security Practices please see here.

10. Retention and Storage

We will retain your personal information as long as necessary to provide the products you have requested, or to otherwise achieve the purpose for which the personal information was collected and processed. Typically, information is retained for the duration of any contractual relationship, or for as long as the information is required for other legitimate business purposes such as resolving disputes, complying with our legal obligations and enforcing our agreements, or as permitted by applicable law. As the purpose for processing the personal information can vary, the retention period for different categories of personal information can also vary. We determine our retention periods in accordance with legal and operational requirements.

We may store personal information in the United States and in any other country where Johnson Controls affiliates, subsidiaries or service providers operate facilities. We maintain data centers in the following locations:

MDC
JCI HQ Glendale
5757 N Green Bay Ave
POB 591
53209
Milwaukee, WI
United States of America

PDC1
HP Suwanee Hosting Center
120 Satellite Boulevard NW
Suwanee, GA
30024
United States of America

PDC2
HP Alpharetta Hosting Center
2525 Westside Parkway
Alpharetta, GA
30040
United States of America

LD7
Equinix LD7
1 Banbury Avenue
Slough
SL1 4KG
United Kingdom

LD9
Equinix LD9
Unit 2 Powergate Site
Park Volt Avenue
London
NW10 6PW
United Kingdom

Singapore
SGP Singapore International
31 International Business Park #03-02
Singapore, 609921
Singapore

Shanghai
JCI HQ Shanghai
North FuQuan Road No 518 Building 11
Shanghai, 200335
China

11. Cookies and Tracking Technologies on our Websites

When you visit our websites, we and our service provider(s) may collect certain information by automated means, using the following technologies: cookies, LSO (local shared objects, also known as flash cookies), local storage (HTML5), web beacons, javascript, and eEtag. For ease of reference we have referred to these technologies as “cookies” throughout.

You have a variety of tools to control the use of cookies. Certain Johnson Controls websites may offer you detailed options for controlling the use of cookies. You can also use the controls in your internet browser to limit cookies. The summary below includes further detailed information about our use of cookies and explains how you can control the use of these technologies via your browser settings.

What are Cookies? Cookies are small text files that a website transfers to your computer or another device through your web browser when you visit a website. We may use cookies to make website sign-in and usage more efficient, and to tailor your browsing preferences and improve the functionality of our websites. Cookies can be used for performance management and to collect analytical information to show how our website is being used. They can also be used for functionality management, enabling us to make the user’s visit more efficient by, for example, remembering language preferences, passwords and log-in details. There are two types of cookies:

a. session cookies: deleted from your device after you leave the website; and

b. persistent cookies: remain on your device longer or until you delete it manually.

Flash Cookies (also known as Local Shared Objects) and similar technologies are intended to personalize and enhance your online experience. The Adobe Flash Player is an application that allows rapid development of dynamic content, such as video clips and animation. We use Flash cookies for security purposes and to help remember settings and preferences similar to browser cookies, but these are managed through a different interface than the one provided by your web browser. To manage Flash cookies, please see the Adobe website or visit www.adobe.com. We may use Flash cookies or similar technologies to deliver information to you based on your previous activities or to serve interest-based advertising.

Server Logs: Our server logs may also collect information about how users utilize the websites (usage data). This data may include a user's domain name, language, type of browser and operating system, Internet service provider, Internet protocol (IP) address, the site or reference directing the user to the website, the website you were visiting before you came to our website, the website you visit after leaving our site, and the amount of time spent on the website. We may monitor and utilize usage data to measure the website's performance and activity, improve the website's design and functionality or for security purposes.

Pixel Tags and Web Beacons: We may use pixel tags and web beacons on our website. These are placed on web pages or in our emails and generate a notification to us if you access the pages or open or click an email. These tools allow us to measure response to our communications and improve our web pages and promotions.

How to Modify Cookie Settings: You can change your browser settings to block or notify you when you receive a cookie, delete cookies or browse a website using your browser’s anonymous usage setting. Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings. If you do not agree to our use of cookies or similar technologies which store information on your device, you should change your browser settings accordingly. You should understand that some features of our websites may not function properly if you do not accept cookies or these technologies.

Consent to Cookies: Where required by applicable law, you will be asked to consent to certain cookies and similar technologies before we use or install them on your computer or other device.

• Data Sharing and Browser "Do Not Track" Requests: We do not (and do not permit others) to track our website visitors, therefore we do not process web browser Do Not Track signals. To learn more about browser tracking signals and Do Not Track please visit http://www.allaboutdnt.org/
• Linked sites: We may provide links to third-party websites (“linked sites”) from our websites. Linked sites are not necessarily reviewed, controlled or examined by us. Each linked site may have its own terms of use and privacy notice, and users must be familiar and comply with all such terms when using linked sites. We are not responsible for the policies and practices of any linked site, or any additional links contained in them. These links do not imply our endorsement of the linked sites or any company or service and we encourage users to read linked sites’ terms and notices prior to using them.
• Google Analytics: We may use Google Analytics on our website to collect information about your online activity on our websites, such as the web pages you visit, the links you click, and the searches you conduct. We may use the information to compile reports and to help us improve the website. The cookies collect information, including the number of visitors to the website, where visitors have come to the site from and the pages they visited. The information generated by those cookies and your current IP-address will be transmitted by your browser to and will be stored by Google on servers in the United States and other countries. Google will use this information on our behalf for the purpose of evaluating your use of our website as described above. The IP address collected through Google Analytics will not be associated with any other data held by Google. For more information about the information gathered using Google Analytics please visit http://www.google.com/intl/en/analytics/privacyoverview.html. You can prevent these cookies by selecting the appropriate settings on your browser. If you do this, you may not be able to use the full functionality of our websites. You may download and install the Google Analytics Opt-out Browser Add-on available here: http://tools.google.com/dlpage/gaoptout.
• Google Remarketing Technology: Our websites may use Google’s remarketing technology. This technology enables users who have already visited our online services and shown interest in our services to see targeted advertising on the websites of the Google partner network. Likewise, users that are similar to the visitors of our website can be served an advertisement. The information generated by the cookie about the website use will be transmitted to and stored on servers in the United States by Google. In the event that the IP address is transferred, it will be reduced by the last 3 digits. Using cookies, the user behavior on a website can be analyzed and subsequently utilized to provide targeted product recommendations and advertising based on the user’s interests. If you would prefer to not receive any targeted advertising, you can deactivate the use of cookies for these purposes through Google by visiting the website: https://www.google.com/settings/ads/. Please note that Google has its own data protection policy which is independent of our own. We assume no responsibility or liability for their policies and procedures. Please read Google’s privacy policy before using our websites (https://www.google.com/intl/en/policies/privacy/).
• Facebook Conversion Tracking: Our websites may utilize the Conversion Tracking Pixel service of Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA (“Facebook”). This tool allows us to follow the actions of users after they are redirected to a provider’s website by clicking on a Facebook advertisement. We are thus able to record the efficacy of Facebook advertisements for statistical and market research purposes. While we cannot see the personal data of any individual user, the collected data are saved and processed by Facebook. Facebook is able to connect the data with your Facebook account and use the data for their own advertising purposes, in accordance with Facebook’s Data Use Policy found under: https://www.facebook.com/about/privacy/. Facebook Conversion Tracking also allows Facebook and its partners to show you advertisements on and outside Facebook. In addition, a cookie will be saved onto your computer for these purposes. Only users over 13 years of age may give their permission. If you would like to revoke your permission: https://www.facebook.com/ads/website_custom_audiences/.
• Interest-Based Advertising: We allow third parties on our websites to use cookies and similar tracking technologies to collect information and infer your interests for interest-based advertising purposes. If you would prefer to not receive personalized ads based on your browser or device usage, you may generally express your opt-out preference to no longer receive tailored advertisements. Please note that you will continue to see advertisements, but they will no longer be tailored to your interests. To opt-out of interest-based advertising by participating companies in the following consumer choice mechanisms, please visit: Digital Advertising Alliance (DAA)’s self-regulatory opt-out page (http://optout.aboutads.info/) and Network Advertising Initiative (NAI)’s self-regulatory opt-out page (http://optout.networkadvertising.org/). If you are located in the European Economic Area, please visit European Interactive Digital Advertising Alliance (EDAA)'s consumer opt-out page (http://youronlinechoices.eu).

12. Your Rights

Depending on your location and subject to local data protection laws, you may have certain rights relating to your personal information. These rights may include:

• A right for you to access your personal information held by us;
• A right to request that we rectify, restrict, erase or delete the personal information held or processed by us; 
• You may have a right to ask for further information about how we are using your personal information; 
• A right to transfer your personal information to another controller; 
• You may have a right to object to the processing of your personal information, including a right to opt-out or object to direct marketing; 
• A right to object to decisions based solely on automated processing (such as profiling) which produces legal effects; 
• A right to withdraw your consent from us at any time, if we are relying on your consent to process your personal information.

If you would like to exercise any of your rights, please refer to our privacy request portal for further information about how you can make a request. Alternatively, you may contact our Privacy Office using the methods provided in the Contact Us section.

Please note that in certain situations Johnson Controls will handle personal information as a data processor on behalf of our customers. In these circumstances, the customer will have determined the means and purposes of the processing and therefore it is the customer who will be responsible for handling and complying with requests to exercise your data protection rights. Where we are a data processor of your personal information please contact the customer directly for assistance.

13. How can I change my communication preferences?

From time to time, we may send you emails, product updates, customer satisfaction surveys, invites for webinars or any other forms of communications containing marketing communications. If we process your personal information for the purpose of sending you marketing communications and you no longer wish to receive these communications, you may opt out at any time. To opt out of receiving direct marketing communications, you can:

• click on the “opt out” links contained in the received email; or
• contact our Privacy Office at privacy@jci.com or using the methods provided in the Contact Us section of our websites.

14. Automated Decision-Making

We respect your rights under law (to the extent provided for by the local laws of your country) regarding automated decision-making. At Johnson Controls, we value fairness – we will examine any models or automated decisions for deliberate fairness so as to minimize bias in the outcomes. We commit to providing a responsible AI environment which establishes trust and confidence in the desired outcomes.

We accomplish this with the understanding that human involvement is crucial. By allowing “human in the loop” determinations to set parameters regarding the automated decision-making in their facility, our customers help maintain the trustworthiness of the technology itself. The goal is to strike a balance between efficient, unbiased automated decisions and enhanced human decisions through AI data delivery.

Where we use camera/video technology and facial recognition we ensure our systems are effective, safe and secure while also implementing strong accountability and governance in order to achieve fairness and compliance. Our core business is to enable healthy, efficient, sustainable and safe buildings for their owners and occupants.  We continuously review our products and their automated decision-making features through this strategic lens to ensure we are driving outcomes that are valuable to our customers.  Our automated decision-making features are designed against that strategic intent and produce societally beneficial outcomes that are not specific to any one person or individual. In the event that decisions are made solely based on automated methods of processing and produce legal effect or significantly affect an individual, we will provide you with the opportunity to question the decision or request manual review.

15. Children

Our websites are not directed at children and we do not use our websites to knowingly solicit personal information from or market to children. If we learn that a child has provided personal information through one of our websites, we will remove that information from our systems.

16. How can I make a complaint?

If you have concerns about the handling of your personal information you can contact our Privacy Office, using the methods provided in the Contact Us section of our websites.

We ask that you contact us in the first instance to try and resolve your concerns. However, depending on the country in which are you are located, you may also have the right to make a complaint to your local supervisory authority.

17. Local Addenda for Certain Countries

We have prepared addenda to this Privacy Notice with specific information for certain countries or regions where required by applicable local law. You can find these complementary privacy notices through the local addenda links below:

• California, USA
• Mexico
• Brazil

18. Modifications to our Privacy Notice

We reserve the right to change, modify, and update this Privacy Notice at any time. If we propose to make any material changes, we will notify you by means of a notice on this page. Please check periodically to ensure that you have reviewed the most current notice.

19. How to Contact Us?

If you would like to communicate with us regarding privacy issues or have questions, comments or complaints, please contact our Privacy Office using the methods provided in the Contact Us section of our websites.

You may also contact us by mail:

Global Privacy Office
Johnson Controls
5757 North Green Bay Avenue 
Milwaukee, Wisconsin 53209
USA

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.