Xerox Privacy Policy

DATED 2020-12-24 · VERSION 20210124_rev01 · COMPARED WITH 20201127_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20201127_rev01 to 20210124_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 Personal data collected by Xerox may be transferred to, stored and processed in your region, the United States, or any other country in which Xerox or its subsidiaries, affiliates, sub-contractors, agents or partners maintain facilities. Our subsidiaries, affiliates, sub-contractors, agents and partners are required by contract to safeguard any personal data they receive from us and are prohibited from using the personal data for any purpose other than to perform the services as instructed by Xerox. We also take steps to provide adequate protection for any transfers of your personal data in accordance with applicable law.
 Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal data from the European Economic Area and Switzerland to other countries. When we do, we use a variety of legal mechanisms, including Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.
 ## Video Links
+Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g., [YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information.
+Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information.
 [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)
 ## EU-U.S. Privacy Shield
+Xerox Corporation complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland to the United States. Xerox Corporation has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If third-party agents process personal data on our behalf in a manner inconsistent with the Privacy Shield Principles, we remain liable unless we prove we are not responsible for the event giving rise to the damage. If there is any conflict between the terms in this privacy statement and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit [www.privacyshield.gov](https://www.privacyshield.gov/).
+**Commitment to Privacy Shield Principles**. Through November 2020, Xerox Corporation certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, both of which were established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland, respectively, to the United States. The EU-U.S. Privacy Shield was recently invalidated by the Court of Justice of the European Union ("EU Court"). The Swiss-U.S. Privacy Shield remains in place, although for reasons similar to those cited by the EU Court, the Swiss DPA has opined that the U.S. does not provide an adequate level of protection for Swiss citizens. _For more explanation on the adequacy of the protection of personal data transferred from the EU and Switzerland to Xerox in the U.S., see below under the headings "Schrems II" and "Transparency Report."_
+In compliance with the Privacy Shield Principles, Xerox commits to resolve complaints about our collection or use of your personal data. European Union or Swiss individuals with inquiries or complaints regarding this privacy statement should first contact Xerox at: [privacy@xerox.com](mailto:privacy@xerox.com) and indicate "Privacy Shield" in the Subject line.
+In anticipation of further developments from EU and Swiss data protection authorities as to a new framework for transfer of personal data of EU data subjects from the EU to the U.S., Xerox continues to comply in practice with the Privacy Principles of the aforementioned Privacy Shield Frameworks. In some cases, we rely on the GDPR Standard Contractual Clauses which contain requirements that are comparable to the Privacy Principles.
+Xerox further commits to cooperate with the panel established by the EU data protection authorities or the Swiss Federal Data Protection and Information Commissioner, as applicable, and comply with the advice given by the panel or commissioner with regard to data transferred from the EU or Switzerland. You may also be able, under certain conditions, to invoke binding arbitration.
+Consistent with its commitment to the Privacy Principles, if third party agents process personal data on Xerox's behalf in a manner inconsistent with the Privacy Shield Principles, we remain liable unless we prove we are not responsible for the event giving rise to the damage. If there is any conflict between the terms in this privacy statement and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
+The Federal Trade Commission has jurisdiction over Xerox's compliance with the Privacy Shield.
+Similarly, Xerox continues its commitment to resolving complaints about our collection or use of personal data. EU and Swiss data subjects with inquiries or complaints regarding this privacy statement or Xerox's collection or use of their personal data should first contact Xerox at: [privacy@xerox.com](mailto:privacy@xerox.com) and indicate "Privacy Shield Query" in the Subject line.
+Xerox also commits to cooperate with the panel established by the EU data protection authorities or the Swiss Federal Data Protection and Information Commissioner, as applicable, and to comply with the advice given by the panel or commissioner with regard to data transferred from the EU or Switzerland. Data subjects may also be able, under certain conditions, to invoke binding arbitration.
+The U.S. Federal Trade Commission has jurisdiction over Xerox's compliance with the Privacy Shield.
+**Schrems II**. Xerox is aware of the July 2020 _Schrems II_ decision of the EU Court that invalidated the EU-U.S. Privacy Shield Framework, and the subsequent opinion of the Swiss DPA regarding the adequacy of the Swiss-U.S. Privacy Shield Framework. As stated above, Xerox continues to adhere to the Privacy Principles in its collection, use and retention of the personal data of EU and Swiss data subjects and to provide adequate security and protection for such data subjects and their personal data that is transferred to it in the U.S.
+The primary basis for the EU Court's decision in _Schrems II_ was its opinion that even taking into account the protections afforded by the EU-U.S. Privacy Shield, national security surveillance conducted by the U.S. federal government can take place without adequate protections for EU data subjects. The two specific authorities upon which the EU Court based its decision are §7022 of the Foreign Intelligence Surveillance Act ("FISA") and Executive Order 12333 ("EO 12333"). Pursuant to these authorities, the U.S. government may obtain secret subpoenas or warrants, the targets of which may include EU data subjects.
+**Transparency Report**. To the best of its knowledge, Xerox Corporation has never received or responded to any national surveillance subpoena or warrant under FISA or EO 12333. Based on this history and Xerox's continued commitment to adhere to the Privacy Principles, EU and Swiss data subjects and our customers may have reasonable assurance that (1) Xerox Corporation is unlikely to receive a FISA or EO 12333 subpoena or warrant targeting the personal data of an EU or Swiss citizen, and therefore the concerns cited by the EU Court in _Schrems II_ are unlikely to be implicated as to such personal data transferred to Xerox in the U.S., and (2) the personal data transferred to Xerox in the U.S. and the rights of EU and Swiss citizens are adequately protected consistent with the requirements of GDPR and the Swiss FADP.
 ## Period of Storage
 Xerox retains personal data for as long as necessary to provide the products and fulfill the services and transactions you have requested or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. Actual retention periods can vary. The criteria used to determine the retention periods include: (i) how long personal data is needed to provide our products or operate our business; (ii) whether the personal data is of a sensitive type; and (iii) whether Xerox is subject to a legal, contractual or similar obligation to retain the data.
 ## Your Privacy Rights
 **Can I Control the Interest-Based Advertising that Xerox Websites Collect About Me?**
 Yes, Xerox provides [a tool to opt-out of data collection](http://preferences-mgr.truste.com/) by companies that adhere to the [Self-Regulatory Program for Online Behavioral Advertising](http://www.aboutads.info/principles/).
 ## Communication Preferences
+Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/perl-bin/formeng.pl) or via an 'opt-out' provided in the communication. You may also mail an unsubscribe request to:
+Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication. You may also mail an unsubscribe request to:
 Marketing Privacy Preferences
 Xerox Corporation
 Marketing Manager
 SW Canyon Creek Road,
 Building 63 MS 7063-630,
 Wilsonville, OR 97070
 This unsubscribe option does not apply to communications primarily for the purpose of administering order completion, contracts, support, product safety warnings, software updates, or other administrative and transactional notices, the primary purpose of which is not promotional in nature.
 Xerox commits to resolve complaints about your privacy and our collection or use of your personal data.
 - US & Canada Toll-Free Number: 1-866-XRX-0001
 - [Direct Dial Toll-Free Numbers Outside US & Canada](https://www.xerox.com/downloads/usa/en/h/HowtoContacttheXeroxEthicsHelpline.pdf) available at [www.xerox.com/ethics](https://www.xerox.com/en-us/about/corporate-citizenship/ethics)
 You may also contact us via postal mail at:
 Xerox Corporation
 Xerox Business Ethics and Compliance Office
 Merritt 7
 Norwalk, CT 06851-1056
 USA
 Xerox Limited is our representative for the European Economic Area and Switzerland:
 Xerox Limited, Riverview, Oxford Road, Uxbridge, UB8 1HS, UK
 The Xerox subsidiary in your country or region can be found [here](https://www.xerox.com/en-us/about/contact-us).
+If you have questions about Xerox products or services, call us toll-free at 1-800-ASK-XEROX or 1-800-275-9376. More contact information is available on [www.xerox.com](https://www.xerox.com/) if you have questions about support, sales, corporate information, scholarships, research and innovation, or services.
+If you have questions about Xerox products or services, call us toll-free at 1-800-ASK-XEROX or 1-800-275-9376. More contact information is available on [www.xerox.com](https://www.xerox.com/index/enus.html) if you have questions about support, sales, corporate information, scholarships, research and innovation, or services.
 ## Statement Updates
 Xerox reserves the right to make changes to this statement. If we make changes, we will revise this privacy statement to reflect such changes and revise the effective date of the statement.
+Statement Effective Date: July 22, 2020.
+Statement Effective Date: December 24, 2020.
 **What Was Revised in this Update?**
+This privacy statement has been updated to state that third party terms and conditions may apply when a user views a video on or through this site.
+The section of this privacy statement entitled "EU-U.S. Privacy Shield" has been updated to describe Xerox's current practices as to the transfer of personal data of EU and Swiss data subjects, to address concerns raised by the recent decision of the Court of Justice of the European Union in Schrems II, and to add a Transparency Report.