• • Personal and business computing devices (desktops, laptops, tablets, IoT ecosystem devices)
• • Enterprise infrastructure (servers, storage systems, networking devices)
• • Smart devices and accessories (displays, docking stations, peripherals, IoT-enabled products)
• • Associated software and cloud-based services (device management tools, data sanitization, software pre-installs, telemetry, remote diagnostics, updates, and (remote) support platforms, AI model adaptation, collaboration connectivity, compatible accessories connectivity).

• • Performance metrics (system health, utilization, resource consumption)
• • Error and diagnostic logs
• • Energy consumption data
• • Telemetry for remote management and updates
• • Usage statistics at device or system level
• • Peripherals, peripherals settings, device BIOs.

• • Data is typically collected in structured, machine-readable formats (e.g., JSON, XML, CSV), but also in unstructured log text format.
• • Collection may be continuous or event-triggered, with summaries transmitted periodically.
• • Depending on the technical design of the product or service, data may be stored either locally on the device or remotely on a server. Where applicable, the intended duration of retention is determined by the nature of the data, technical feasibility, and contractual or regulatory requirements.
• • Typically, data is stored for the duration of the statutory warranty period, as defined by the national laws of the respective EU Member State. In certain cases, the warranty period may be extended based on individual contractual agreements with the User. Retention periods may therefore differ depending on the product or service type, data category, or applicable legal requirement. Additionally, data may be retained for longer periods where necessary, for example, to support research and development activities, to resolve product quality issues, or to comply with statutory retention obligations under commercial or tax law. Where personal data is involved, retention is subject to applicable data protection laws, and data will be deleted once the purpose of processing no longer applies, unless legal obligations require longer storage.

• • Customers / Users:

  Access to data generated by the product or service can be provided either directly or indirectly, depending on the design and technical setup.

  • Direct Access

    Users have the technical means to access their data without needing to request it. Depending on the nature of the product or service and relevant technical parameters, Users can:

  • Export device-related data and activity history directly from the device.

  • Access data via management dashboards, APIs, or on-device interfaces.

  • Use authentication systems such as Lenovo ID, or their own Single Sign-On (SSO) system to access data.

  • In some cases, users may also be able to retrieve or erase certain data directly, depending on the technical setup and available functionalities.

  • Delete customer-owned device data by removing the device from the TSM Portal.

  •  Indirect Access

    If the product or service does not support direct access, Users and Customers may request access, retrieval, or erasure of relevant data by contacting Lenovo. In such cases, Lenovo will process the request in accordance with applicable legal and contractual obligations.

• • Service Providers & Partners may access relevant diagnostic data directly or indirectly strictly for support and maintenance, under contractual agreements. Sharing data is usually governed by legal requirements, service necessity, or user consent, with safeguards to protect data security. Common examples include:

  • IT & Cloud Service Providers to host data or enable secure data transmission; these providers are bound by contracts to protect data and only use it for Lenovo’s specified purposes.
  • Maintenance & Repair Partners
  • Analytics Partners: To process anonymous statistical data (e.g., app usage metrics) and generate insights for improving software performance—this data is often de-identified to avoid linking to individual users.
  • Business Partners for Co-Owned/Co-Delivered services if Lenovo offer products or services jointly with other companies (e.g., a tablet preloaded with third-party software, or a bundled cloud service), it may share relevant data with these business partners — only to the extent needed to deliver the co-provided service and other.
• • Other third parties: Data may be shared with global third-party service providers (e.g., cloud hosting), limited to technical operation and subject to security safeguards.
• • Affiliates: Lenovo shares data with its global group companies (e.g., regional subsidiaries or business units in markets like Europe, Asia, or the Americas) to support consistent service delivery, cross-regional device management, and compliance with local regulations.

Where Lenovo controls access over data generated by the product or  service, it may use readily available data for purposes including fulfilling contractual obligations, complying with legal requirements, improving product quality, supporting research and development, and enhancing customer experience.

If Lenovo intends to share data with third parties, this third party is only allowed to use the data for purposes that have been agreed upon with the User.

• • Users may request access, retrieval, and portability of data in a structured format.
• • Users may request erasure of stored data, subject to technical feasibility and contractual obligations.
• • Users may request data sharing with a third party or termination of this data sharing where feasible.
• • The duration of the contractual relationship between the User and Lenovo as a prospective data holder depends on the nature of the product or service. Users may terminate this relationship in accordance with the applicable terms and conditions.
• • Users have a right to lodge a complaint to the designated competent supervisory authority if they believe that any provision of Chapter II of the EU Data Act has been infringed. However, users are encouraged to reach out to us in case of any concerns.

We apply appropriate technical and organizational safeguards, including encryption, access control, and anonymization where relevant. Proprietary trade secrets are protected, while still ensuring users' rights to access and portability.

For questions about this Declaration or to exercise data access rights under the EU Data Act, please contact: privacy@lenovo.com. You can also contact the Lenovo entity in the country in which you purchased the product or service. If no affiliate in the country of purchase is identified by Lenovo then you can contact LENOVO IRELAND INTERNATIONAL LIMITED, Viscount House 6/7 Fitzwilliam Square East Dublin 2 Dublin, Dublin (IE-D), D02 Y447 Ireland.