STIHL Ethics Channel

STIHL is committed to ethics, respect for employees, transparency, seriousness and accuracy in the investigation of reported occurrences, in addition to the confidentiality of whistleblowers and ensuring non-retaliation to them.

Any act that does not comply with the rules, laws or STIHL’s Code of Ethics and Conduct must be reported. In addition, any information or situation that may harm STIHL or anyone related to it is important, deserves attention and should be reported to STIHL’s Ethics Channel.

Making a report is an act that requires responsibility. In this context, attitudes of violation of the Code and unethical attitudes will be considered:
1. Omission in the face of knowledge of possible violations by employees, customers, suppliers or partners;
2. Making a report about made up situations aiming to harm someone or other companies because of personal interests.

This channel is operated by an independent company, which will be attentive to the confidentiality of your information. Reports can be made without identification, that is, anonymity is allowed. Thus, there is no information collection that has not been freely provided.

Access STIHL's Code of Ethics and Conduct by clicking here.
Access the Code of Ethics and Conduct for Business Partners by clicking here.

You can also register your report by sending an e-mail to: canaldeeticastihl@ethicspeakup.com or contacting us at 0800 721 1425.

If you have any questions about what should or should not be reported in this Channel, please check the "Frequently Asked Questions" section available on this Site, STIHL’s Code of Ethics and Conduct, your Leadership or STIHL’s Ethics Committee, which may be contacted by the e-mail comitedeetica@stihl.com.br. Your confidentiality will be respected.

By the present instrument called “Privacy Notice”, aiming to regulate the use of the Reporting Channel operated by Deloitte Touche Tohmatsu to its customers, the definitions stipulated in that term comprise the following parts:

Deloitte Touche Tohmatsu, hereinafter referred to as “DELOITTE”

STIHL Ferramentas Motorizadas Ltda, hereinafter referred to as “COMPANY”

By registering a report in this Confidential Reporting Channel (via website or 0800), you will be able to provide us with personal data (information that identifies or may lead to the identification of an individual) and sensitive personal data (racial or ethnic origin, religious belief, political opinion, membership in a union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data) about you; Manifestant, denounced or third party mentioned in the report or report.

This Privacy Notice is intended to clarify how DELOITTE and the COMPANY treat your personal data and sensitive personal data (collectively referred to here as personal data only) when you contact us to use the services of the Confidential Reporting Channel or when you has been quoted in a report.

All personal data collected in this Confidential Reporting Channel will be treated by DELOITTE and COMPANY in accordance with the provisions of the General Personal Data Protection Law (Law No. 13,709 / 2018 - “LGPD”) and relevant regulations.

To find out more details about the measures we apply in the treatment of personal data, access DELOITTE's Privacy Policy, as well as the COMPANY's Privacy Policy through the link https://www.stihl.com.br/protecao-de-dados-pessoais.aspx If you are a COMPANY employee, the Privacy Policy can be found on the COMPANY’s intranet.

1. What types of personal data are collected?

Only personal data will be collected to be provided voluntarily by the Manifestant through record registration in this Confidential Reporting Channel - via email, website or 0800.
Any personal data reported in the report that are considered excessive, unnecessary or that have no relevance for determining what happened will be disregarded and will only be stored for the purpose of maintaining the completeness of the original text contained in the report / report / complaint, for the period necessary to achieve treatment purposes.

Manifestant:
The Manifestant's personal data will be collected according to the chosen identification profile, which may include name, gender (statistical purposes), position, area, email, phone, cell phone, type of audience and voice recording (reports via 0800).
In addition, any other personal data contained in the report / report / report and in files attached by the Manifestant may be collected, which may include images, voice recordings and other types of personal data.

Reported and third parties:
The following personal data may be collected from denounces and third parties based on a report / report / complaint registered voluntarily by the Manifestant:
i) name, surname, position and place of work;
ii) description of the suspected violation of the Code of Ethics and Conduct, COMPANY policies, and / or relevant law and regulations, including all relevant facts and details;
iii) any other personal data that may be mentioned by the Manifestant during the description of what happened, which may include images, voice recordings and other types of personal data.
This Confidential Reporting Channel is not designed or intentionally directed to collect personal data from children and adolescents. However, in eventual situations in which the collection of these types of personal data is necessary in the context of receiving and investigating a report / report / complaint, the treatment will occur in the best interests of the child and / or adolescent and all provisions of the LGPD relevant regulations and regulations will be respected.

2. Qual a finalidade da coleta dos dados pessoais?

Manifestant:
The processing of personal data has the objective of allowing the identification and contact between DELOITTE and / or the COMPANY and the Manifestation to clarify doubts, collect additional information and progress of the investigations, respecting, in any case, the profile of identification chosen by the Manifestant (identified, confidential or anonymous). In addition, these data may be processed for the purpose of complying with legal or regulatory obligations, regular exercise of rights and statistical analysis (anonymously).

Reported and third parties:
The collection of this personal data has the purpose of verifying the reported facts and taking the necessary measures, in accordance with the applicable legislation. Such investigation will be carried out by the COMPANY, DELOITTE being merely an intermediary, responsible only for the sharing of personal data and reports registered in this Confidential Reporting Channel. In addition, these data may be processed for the purpose of complying with legal or regulatory obligations, regular exercise of rights and statistical analysis (anonymously).

3. What is the legal basis that justifies the processing of personal data?

All personal data collected will be treated based on the legitimate interests of the COMPANY and sensitive personal data based on regular exercise of rights or fraud prevention, since both treatments, in the context and scope of the services provided by DELOITTE, aim to help COMPANY in investigating, preventing and mitigating behavior and misconduct that violate the COMPANY's Code of Ethics, internal policies, relevant laws and regulations.
It is also possible that the processing of personal data and sensitive personal data occurs to comply with legal or regulatory obligations, depending on the situation reported and the alleged misconduct practiced.

4. With whom do we share the personal data collected?

The personal data of the Manifestant, denounced and third parties may be shared with:

i) THE COMPANY, for the purposes of science, investigation and investigation of the content of the report, always respecting the Manifestator's identification profile;
ii) Government authorities, bodies and entities, to comply with legal or regulatory obligations and regular exercise of rights;
iii) Technology companies that manage the integrated systems or are responsible for the storage and guarantee of security in the treatment of the personal data collected; and
iv) Third-party companies that may replace DELOITTE in the provision of services of the Confidential Reporting Channel to the COMPANY.

For more details on the shares described above, contact DELOITTE's Data Protection Officer / DPO (e-mail dpo@deloitte.com.br).

5. How long is personal data stored for?

Personal data will only be kept for as long as necessary to fulfill the purposes described in this document or as necessary to comply with legal or regulatory obligations and regular exercise of rights. When personal data are no longer necessary or relevant for the intended purposes, they will be deleted.
For statistical purposes, personal data will remain stored anonymously.

6. What are the rights regarding personal data?

According to the LGPD, holders have several rights over their personal data, including: confirmation of treatment, access to personal data, updating and correction of incorrect, incomplete or inaccurate personal data; anonymization, blocking and elimination of unnecessary, excessive or treated personal data in breach of the LGPD; opposition to the processing of personal data, when we no longer have a legitimate or legal need to process them; information on sharing personal data with public and private entities.
These rights are not absolute and must be interpreted in the light of legislation and other regulations. Thus, DELOITTE will evaluate the right requests individually in order to keep the Confidential Reporting Channel confidential and confidential and not to compromise the progress of investigations and investigations that may be ongoing with the COMPANY.
It is noteworthy that when the Manifestant chooses not to identify himself when registering the report, DELOITTE cannot guarantee access to the rights provided for in the LGPD since he will not have access to the identification data of the holder.
If you want to access any of your rights provided for in the LGPD for free, contact the DPO of DELOITTE through the email dpo@deloitte.com.br

7. Security

DELOITTE will adopt technical and organizational measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or illicit treatment.
In addition, access to personal data is restricted only to DELOITTE professionals who need to access it to develop activities related to the treatment of the report.
Whenever possible and applicable, anonymization and encryption techniques will be adopted for the security of personal data.

8. Changes

This document can be changed without prior notice, as in cases of change in legislation or any decision or guidance from the National Personal Data Protection Authority (“ANPD”). It will be the full responsibility of the Demonstrator to periodically review the content so that it has access to such changes.