Xerox Privacy Policy

DATED 2020-12-24 · VERSION 20210810_rev01 · COMPARED WITH 20210516_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20210516_rev01 to 20210810_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

11## Xerox Privacy Statement
22
33## Introduction
44
5This privacy statement covers the websites and applications of Xerox Corporation ("Xerox" or "we") that include a link to this statement. This privacy statement also applies to Xerox's marketing and advertising practices where and when it is referenced. It is meant to inform you about our collection and use of your personal data.
5This privacy statement covers the websites and applications of Xerox Holdings Corporation ("Xerox" or "we") that include a link to this statement. This privacy statement also applies to Xerox's marketing and advertising practices where and when it is referenced. It is meant to inform you about our collection and use of your personal data.
66
77## Personal Data We Collect
88
99You may choose to give us personal data to allow us to communicate with you, process your orders, provide you with services, or for employment consideration. Data we collect depends on the context of your interactions with Xerox, the choices you make, including your privacy settings, and the products and features you choose. The personal data we collect can include the following:
1010
1111**Name and Contact Data**. Your first and last name, email address, postal address, phone number and other similar contact data in order to communicate with you, process orders or provide you with products or services. We may also collect your employer name, if you are procuring products or services on behalf of an organization.
9595Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal data from the European Economic Area and Switzerland to other countries. When we do, we use a variety of legal mechanisms, including Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.
9696
9797## Video Links
9898
9999Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)
100100
101## Applications
102
103Use of **Print from Google Drive** or **Scan to Google Drive (each an "Application" and together the "Applications")** may take you to your Google Drive. Your Google Drive is a third party site and Xerox has no control over the privacy policies or terms of use of that site. The Applications present you with Google Drive login screens, so that you enter your credentials directly into Google. The Applications display your Google Drive content directory (file and folder names). The **Print from Google Drive** application will temporarily download a selected file, submit it to the device for printing, then delete the file after printing. The Applications do not store your credentials. By using the Applications, you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. Read more about how Google uses your information [**here**](https://www.google.com/policies/privacy/partners/).
104
101105## EU-U.S. Privacy Shield
102106
103107**Commitment to Privacy Shield Principles**. Through November 2020, Xerox Corporation certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, both of which were established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland, respectively, to the United States. The EU-U.S. Privacy Shield was recently invalidated by the Court of Justice of the European Union ("EU Court"). The Swiss-U.S. Privacy Shield remains in place, although for reasons similar to those cited by the EU Court, the Swiss DPA has opined that the U.S. does not provide an adequate level of protection for Swiss citizens. _For more explanation on the adequacy of the protection of personal data transferred from the EU and Switzerland to Xerox in the U.S., see below under the headings "Schrems II" and "Transparency Report."_
104108
105109In anticipation of further developments from EU and Swiss data protection authorities as to a new framework for transfer of personal data of EU data subjects from the EU to the U.S., Xerox continues to comply in practice with the Privacy Principles of the aforementioned Privacy Shield Frameworks. In some cases, we rely on the GDPR Standard Contractual Clauses which contain requirements that are comparable to the Privacy Principles.
106110
113117The U.S. Federal Trade Commission has jurisdiction over Xerox's compliance with the Privacy Shield.
114118
115119**Schrems II**. Xerox is aware of the July 2020 _Schrems II_ decision of the EU Court that invalidated the EU-U.S. Privacy Shield Framework, and the subsequent opinion of the Swiss DPA regarding the adequacy of the Swiss-U.S. Privacy Shield Framework. As stated above, Xerox continues to adhere to the Privacy Principles in its collection, use and retention of the personal data of EU and Swiss data subjects and to provide adequate security and protection for such data subjects and their personal data that is transferred to it in the U.S.
116120
117121The primary basis for the EU Court's decision in _Schrems II_ was its opinion that even taking into account the protections afforded by the EU-U.S. Privacy Shield, national security surveillance conducted by the U.S. federal government can take place without adequate protections for EU data subjects. The two specific authorities upon which the EU Court based its decision are §7022 of the Foreign Intelligence Surveillance Act ("FISA") and Executive Order 12333 ("EO 12333"). Pursuant to these authorities, the U.S. government may obtain secret subpoenas or warrants, the targets of which may include EU data subjects.
118122
119**Transparency Report**. To the best of its knowledge, Xerox Corporation has never received or responded to any national surveillance subpoena or warrant under FISA or EO 12333. Based on this history and Xerox's continued commitment to adhere to the Privacy Principles, EU and Swiss data subjects and our customers may have reasonable assurance that (1) Xerox Corporation is unlikely to receive a FISA or EO 12333 subpoena or warrant targeting the personal data of an EU or Swiss citizen, and therefore the concerns cited by the EU Court in _Schrems II_ are unlikely to be implicated as to such personal data transferred to Xerox in the U.S., and (2) the personal data transferred to Xerox in the U.S. and the rights of EU and Swiss citizens are adequately protected consistent with the requirements of GDPR and the Swiss FADP.
123**Transparency Report**. To the best of its knowledge, Xerox Holdings Corporation has never received or responded to any national surveillance subpoena or warrant under FISA or EO 12333. Based on this history and Xerox's continued commitment to adhere to the Privacy Principles, EU and Swiss data subjects and our customers may have reasonable assurance that (1) Xerox Holdings Corporation is unlikely to receive a FISA or EO 12333 subpoena or warrant targeting the personal data of an EU or Swiss citizen, and therefore the concerns cited by the EU Court in _Schrems II_ are unlikely to be implicated as to such personal data transferred to Xerox in the U.S., and (2) the personal data transferred to Xerox in the U.S. and the rights of EU and Swiss citizens are adequately protected consistent with the requirements of GDPR and the Swiss FADP.
120124
121125## Period of Storage
122126
123127Xerox retains personal data for as long as necessary to provide the products and fulfill the services and transactions you have requested or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. Actual retention periods can vary. The criteria used to determine the retention periods include: (i) how long personal data is needed to provide our products or operate our business; (ii) whether the personal data is of a sensitive type; and (iii) whether Xerox is subject to a legal, contractual or similar obligation to retain the data.
124128
125129## Your Privacy Rights
197201Yes, Xerox provides [a tool to opt-out of data collection](http://preferences-mgr.truste.com/) by companies that adhere to the [Self-Regulatory Program for Online Behavioral Advertising](http://www.aboutads.info/principles/).
198202
199203## Communication Preferences
200204
201205Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication. You may also mail an unsubscribe request to:
202206
203Marketing Privacy Preferences Xerox Corporation Marketing Manager 27063 SW Canyon Creek Road, Building 63 MS 7063-630, Wilsonville, OR 97070
207Marketing Privacy Preferences Xerox Holdings Corporation Marketing Manager 27063 SW Canyon Creek Road, Building 63 MS 7063-630, Wilsonville, OR 97070
204208
205209This unsubscribe option does not apply to communications primarily for the purpose of administering order completion, contracts, support, product safety warnings, software updates, or other administrative and transactional notices, the primary purpose of which is not promotional in nature.
206210
207211Xerox commits to resolve complaints about your privacy and our collection or use of your personal data.
208212
209213To report your inquiries or concerns to the Xerox Business Ethics and Compliance Office please contact the Xerox Ethics Helpline. The Xerox Ethics Helpline is confidential and anonymous, if you so desire, and is available online and via the toll-free number listed below.
213217- US & Canada Toll-Free Number: 1-866-XRX-0001
214218
215219- [Direct Dial Toll-Free Numbers Outside US & Canada](https://www.xerox.com/downloads/usa/en/h/HowtoContacttheXeroxEthicsHelpline.pdf) available at [www.xerox.com/ethics](https://www.xerox.com/en-us/about/corporate-citizenship/ethics)
216220
217221You may also contact us via postal mail at:
218222
219Xerox Corporation Xerox Business Ethics and Compliance Office 201 Merritt 7 Norwalk, CT 06851-1056 USA
223Xerox Holdings Corporation Xerox Business Ethics and Compliance Office 201 Merritt 7 Norwalk, CT 06851-1056 USA
220224
221225Xerox Limited is our representative for the European Economic Area and Switzerland:
222226
223227Xerox Limited, Riverview, Oxford Road, Uxbridge, UB8 1HS, UK
224228
225229The Xerox subsidiary in your country or region can be found [here](https://www.xerox.com/en-us/about/contact-us).