1. Controller of personal data

This website is operated by

Metabo Power Tools SA (Pty.) Ltd.

165 Van Der Bijl St

Meadowdale, 

Germiston, 1610, 

South Africa

which you can contact via e-mail to: ZA-info@koki-group.com

We are jointly responsible for the processing that takes place on the website https://hikoki-powertools.eu/za/en/, with

Koki Holdings Europe GmbH

Metabo-Allee 1

D-72622 Nürtingen

Germany

which you can contact via e-mail to: de-marketing.hikoki@koki.eu 

This means that you can contact Metabo Power Tools SA (Pty.) Ltd. or Koki Holdings Europe GmbH with any questions regarding data protection on the website, in particular if you wish to assert your rights.

Metabo Power Tools SA (Pty.) Ltd.is solely responsible for processing outside the above-mentioned website, for example in connection with repair services.

2. Purpose

This document outlines the specific information that we are obligated to provide to data subjects in the EU and EEA under the General Data Protection Regulation ((EU) 2016/679 GDPR) established by the EU. These regulations specify the rights of data subjects and the protocols for managing personal data.

3. Scope of this privacy policy

This document covers our processing of your personal data on our website https://hikoki-powertools.eu/za/en/. 

4. Contact information for Data Protection:

POPI Act Officer: Dietmar Bothner

Metabo Power Tools SA (Pty.) Ltd.

165 van der Bijl Street,

Meadowdale,

Germiston,

1610,

South Africa,

Phone: (+27) 87-808 2200

E-mail: ZA-info@koki-group.com

Data Protection Officer

c/o Koki Holdings Europe GmbH 

Metabo-Allee 1 

D-72622 Nürtingen

Germany

dpo@enobyte.com

5. Legal grounds of our processing

We will only process your personal data if there is a legal basis to do so. Under GDPR and POPIA, there are three legal bases that we use.

(1) Consent (Art. 6 (1) a) GDPR) – If consent is freely provided by you, we are allowed to process your personal data only for the purpose for which the consent was given.

(2) Contractual obligation (Art. 6 (1) b) GDPR) – If we have a contract with you, we will need to store and use some information about you. The same is true if we take necessary steps at your request prior to entering into a contract.

(3) Legitimate interest (Art. 6 (1) f) GDPR) – Legitimate interest allows us to process personal data if it is necessary for our legitimate interests and your interests or fundamental rights and freedoms do not outweigh our interest. We will inform below if we do such processing and what interests we pursue.

6. Use of this website

When you visit our website, the servers automatically save server log file information sent by your browser. This information includes:

Content data

- Any text you enter or files you upload

Usage data

- Websites visited

- Date and time of your request

Metadata

- Your IP-address

- Your computers time zone

- Your computers date and time

- The website you requested

- Which website you came from

- Information about your browser (version, language, fonts installed)

- Information about your operating system (version, language)

- Potentially other information your browser sends via the HTTP protocol.

Temporary storage of the IP-address by the system is necessary to display website content on your device. The information is used exclusively to maintain the technical operation of the servers and the network and ensure its security. The legal basis is our legitimate interest to provide the website in a secure manner (Article 6 (1) f) GDPR).

We automatically delete all server-logs within 14 days. We store the logs for this time to see suspicious activities in our server and protect our infrastructure from outside attacks such as DDoS.

We use an external hosting provider to serve the website. The provider receives and stores the content data, usage data and metadata on our behalf. We use following external hosting providers:

(1) Cloudflare, Inc.

We use Cloudflare, Inc. as our CDN-provider to load some pictures, videos and elements of this website. The CDN-provider will receive usage data and metadata of your visit. By using a CDN, we can more efficiently provide you with the information you requested and keep our website secure. The legal basis for this use is our legitimate interest (Article 6 (1) f) GDPR).

Cloudflare, Inc. is located in 101 Townsend St, San Francisco, CA 94107. USA.

You can review their privacy policy here: https://www.cloudflare.com/en-gb/privacypolicy/ 

(2) Leaseweb Netherlands B.V.

We use Leaseweb Netherlands B.V. as our Hosting-provider to host our services of this website. The legal basis for this use is our legitimate interest (Article 6 (1) f) GDPR).

Leaseweb Netherlands B.V. is located in Hessenbergweg 95, 1101 CX Amsterdam, The Netherlands. 

You can review their privacy policy here: https://www.leaseweb.com/en/about-us/legal/personal-data-protection-acts 

6.1 Contact form

If you use our contact form (https://hikoki-powertools.eu/za/en/contact/), we will receive and store the information you have entered additional to the information described above.

Some fields in the contact form are mandatory, so you have to fill these in to send your message. Others are optional, and you can decide if you want to provide the information.

We will use the information you have entered to respond to your message and take any actions you may have requested.

We do not use the information for other purposes and delete it as soon as we have completed your request, unless a legal obligation forces us to keep the information for longer.

Our mandatory fields are:

- Email: We need this to respond to you

If you do not want to give certain information, you can also enter false data. However, in some cases we will not be able to respond to your message if information is missing.

Our basis for this processing is our contractual obligation if your message concerns purchasing or services offered by us.

If you have a general request, our legal basis is legitimate interest, as we want to give you the best service we can.

6.2 Newsletter and Marketing Automation

On our websites, you can register to have the HiKOKI newsletter sent to you and register for direct digital communications. If you register for the newsletter, you will receive interesting information, offers and news about HiKOKI and our products from us. You can revoke your consent to use your data for advertising purposes at any time. We use Marketing Automation Tool Click, a service of ClickDimensions LLC 5901, Peachtree Dunwoody Road, Suite C370, Atlanta GA 30328, USA, to send out digital advertisements. This tool enables marketing functions with a focus on inbound marketing, lead management, multi-channel measures and campaign measurements. Its functions include email marketing, campaign automation, web intelligence, surveys, web forms, landing pages and much more, and these support us in appealing to potential and existing customers through a wide range of digital channels. The data elements used in marketing automation include contact details (email address, name, etc.), email events (open rate, click rate, unsubscribe rate, etc.), web form and survey submissions, profile management (contact data sets), web tracking data (IP addresses, page impressions and views, URLs, timestamps, operating system data, etc.). Further information is available in the ClickDimensions data privacy policy www.clickdimensions.com/about/privacy-policy/.

6.3 Cookies on this website

Cookies are small text files that any website can write into your browser. Cookies may be set by ourselves (first party cookies), or by third parties. If we set a cookie in your browser, other websites cannot read it. If other third parties set a cookie in your browser, any other website which uses the same third party cookies can read the information stored in these cookies.

This allows for tracking functionality across websites. If we use third party cookies, we will always ask for your consent before placing these cookies.

Below you can see a list of first party cookies which we set:

The following table shows a list of third party cookies we use:

7. Third Parties

On our websites, we may embed tools and contents loaded from the servers of third party service providers. Examples of this may be graphics, videos, social-media buttons, or other functionalities.

Whenever you access a website which embeds such contents, your IP-address will be transmitted to these third parties.

Occasionally these tools might include so called web beacons, invisible graphics that are used to gather further statistics. If you notice any such web beacon, please notify us and we will strive to remove it from our websites.

Some third-party contents will also set cookies in your browser to store certain information on your usage of the tools and contents.

Occasionally, the third party might connect your information gathered on our websites to other information they have collected in order to build a profile on you.

7.1 Google Analytics

If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). The legal basis for this data processing is your consent (Article 6 (1) a) GDPR).

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

We use the User ID function. User ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and to analyze user behavior across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have personalized ads enabled (interests and demographics) and ads can be delivered to these users in cross-device remarketing campaigns.

Google Analytics 4 has IP anonymization enabled by default. Due to IP anonymization, your IP-address will be shortened by Google within Member States of the EU or in other states party to the Agreement on the EEA. Only in exceptional cases will the full IP-address be transferred to a Google server in the USA and shortened there. According to Google, the IP-address transferred by your browser as part of Google Analytics will not be merged with other Google data.

During your website visit, your user behavior is recorded in the form of "events". Events can be:

- Page views

- First visit to the website

- Start of session

- Web pages visited

- Your "click path", interaction with the website

- Scrolls (whenever a user scrolls to the bottom of the page (90%))

- Clicks on external links

- Internal search queries

- Interaction with videos

- File downloads

- Seen Ads / clicked Ads

Also recorded:

- Your approximate location (region)

- Date and time of your visit

- Your IP-address (in shortened form)

- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)

- Your internet service provider

- The referrer URL (via which website/advertising medium you came to this website)

On behalf of the operator Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 serve to analyze the performance of our website.

Recipients of the data are/may be

- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO),

- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

- Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

For the USA, the European Commission adopted a new adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider to establish an appropriate level of data protection in those countries.

The data sent by us and linked to cookies are automatically deleted after 12 months. The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.

You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP-address) by Google, and the processing of this data by Google, by

- not giving your consent to the setting of the cookie or

- downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout.

For more information about Google and how Google handles data, please refer to the following link:

- Term of use: https://marketingplatform.google.com/about/analytics/terms/us/ 

- Data protection: https://support.google.com/analytics/answer/6004245?hl=en 

- Use of cookies: https://support.google.com/analytics/answer/11397207?hl=en 

- Privacy policy: https://policies.google.com/privacy?hl=en 

7.2 Matomo Web Analytics

We use Matomo, an open-source web analytics platform, to analyze and improve the performance of our website. Matomo is configured to operate without cookies, ensuring that no tracking cookies are stored on your device.

Data Processing and Legal Basis

Matomo collects anonymized data about website visits, such as:

  • Pages viewed and time spent on the site

  • Anonymized IP addresses (e.g., shortened IPs to prevent identification)

  • Device type, operating system, and browser version

  • Referring websites (if applicable)

This data is processed based on our legitimate interest (Article 6 (1) f) GDPR) in optimizing our website and ensuring a high-quality user experience. Since Matomo is configured without cookies and anonymizes IP addresses, no personally identifiable information is stored.

For further information on how Matomo processes data, please visit Matomo’s privacy policy (https://matomo.org/privacy-policy/).

8. Transfer of personal data to third countries

In order to fulfill the contract with the customer or to carry out the procedure according to the request of the customer prior to the conclusion of the contract, we may transfer personal data to a third country (including those countries where the adequate level of data protection have not been qualified). We shall use appropriate security and confidentiality measures in accordance with this Privacy Policy and laws when transferring customer’s personal data.

9. Retention periods of personal data

We will generally delete your personal data as soon as we no longer require it for the purposes for which we collected it. If any legal obligation stops us from deleting your information for a certain time, we will stop access to this information, store it securely and delete it after our legal obligation has ended.

10. Your rights

At any time you can exercise your rights by contacting us or our Data Protection contacts directly. Please be aware that we might ask for some sort of verification of identity in order to safeguard other data subjects. These verification will be made as non-intrusive as possible.

You have the following rights:

(1) Right of access

(2) Right to rectification and erasure

(3) Right to restriction of processing

(4) Right to data portability

(5) Right to withdraw your consent

10.1 Right to lodge a complaint

You have the right to lodge a complaint with the South African Information Regulator. See the Information Regulator contact details below.

Physical Address:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Postal Address:   P.O Box 31533, Braamfontein, Johannesburg, 2017

Complaints email:PAIAcomplaints@inforegulator.org.za 

General inquiries email:enquiries@inforegulator.org.za

10.2 Right to object

You have the right to object to any processing we do on grounds of our legitimate interest, if your particular situation challenges our balance of interests.

Unless we can demonstrate legitimate grounds for processing which overrides your interests, rights, and freedoms, and if we do not need your personal data for the establishment, exercise of defense of legal claims, we will no longer process your personal data.

February 2026

The Promotion of Access to Information Act

The Promotion of Access to Information Act, No 2 of 2000 (“The Act” or “PAIA”) was enacted on 3 February 2000, giving effect to the right of access to any information held by Government, as well as any information held by another person who is required for the exercising or protection of any rights. This right is entrenched in the Bill of Rights in the Constitution of South Africa. Where a request is made in terms of The Act, the body to which the request is made is not obliged to release the information, except where The Act expressly provides that the information may or must be released. The Act sets out the requisite procedural issues attached to such request.

• PAIA Manual
• Form 2
• Form 3
• External Privacy Notice