Xerox Xerox Privacy Policy changes — 20210516_rev01

26

28

27

29

**Products.** Certain Xerox products collect data, such as product registration, device serial number, meter reads, supply levels, equipment configuration and settings, software version, and fault codes. Xerox uses this information for product improvement, billing, report generation, supplies replenishment and support services.

28

30

29

31

**Third Party Sources**. We also obtain data from third-parties. These third-party sources vary over time, but they are sources deemed credible by us and may be publicly available or available on a commercial basis. They can include:

30

32

31

33

- Data brokers from which we purchase demographic data to supplement the data we collect;

34

32

35

- Social networks when you grant permission to a Xerox product to access your data on one or more networks;

36

33

37

- Designated entities within your business or enterprise (such as a member of your IT department) in the course of providing services to you;

38

34

39

- Partners with whom we offer branded services or engage in joint marketing activities. If you purchase Xerox services or products from a Xerox partner we may receive certain information about your purchase from that partner;

40

35

41

- Fraud prevention agencies or credit reporting agencies in connection with credit determinations; and

42

36

43

- Publicly available sources such as open government databases or other data in the public domain.

37

44

38

45

## How We Use Personal Data

39

46

40

47

We collect and process personal data with your consent, as required by law, or as necessary to fulfill the legitimate interests or business purposes of Xerox, including to: (i) provide you with products and services; (ii) manage, administer and operate our business; (iii) meet our contractual and legal obligations; (iv) carry out direct marketing; (v) prevent fraud; and (vi) protect the security of our systems and our customers.

41

48

42

49

Xerox uses personal data to:

43

50

44

51

- respond to your questions and communicate with you;

52

45

53

- provide customer support;

54

46

55

- share news, updates, or helpful tips about Xerox products and services;

56

47

57

- enable online shopping;

58

48

59

- inform you of special promotions and other advertising;

60

49

61

- allow you to sign up for online services;

62

50

63

- create reseller partnerships;

64

51

65

- receive and evaluate job applications;

66

52

67

- customize, analyze, and improve our products, services, technologies, communications and relationships with you;

68

53

69

- deliver products and services requested by you;

70

54

71

- notify you about administrative matters that pertain to your Xerox products or services; and

72

55

73

- in the event of a merger or acquisition of Xerox or a substantial portion of its assets, disclose or transfer personal data to the surviving or acquiring party, respectively.

56

74

57

75

Personal data that is submitted in a business capacity may be merged with available business database directories.

58

76

59

77

We share your personal data as necessary for Xerox's business purposes, to complete a transaction or provide a product or service you have requested or authorized. For example, when you provide payment data to make a purchase, we will share your payment data with banks and other entities that process payment transactions or provide other financial services, and with consumer reporting agencies for fraud prevention and credit risk reduction.

60

78

61

79

We share personal data among Xerox affiliates and subsidiaries to efficiently manage the operation of our business. We also share personal data with vendors or agents working on our behalf for the purposes described in this statement or in our contracts with you. For example, companies we've hired to provide customer service support or assist in maintaining or servicing business accounts or products via our systems and services may need access to personal data to provide those functions. In addition, we may share information with third parties for the joint offering of a product or service. In such cases, these companies are required by contract to abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.

62

80

63

81

Finally, we will transfer or disclose personal data when we have a good faith belief that doing so is necessary to:

64

82

65

83

- Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;

84

66

85

- Protect our customers, for example to prevent attempts to defraud users of our products, or to help prevent the loss of life or serious injury of anyone; or

86

67

87

- Operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.

68

88

69

89

We do not sell your personal data to third parties.

70

90

71

91

## Where We Process and Store Personal Data

72

92

73

93

Personal data collected by Xerox may be transferred to, stored and processed in your region, the United States, or any other country in which Xerox or its subsidiaries, affiliates, sub-contractors, agents or partners maintain facilities. Our subsidiaries, affiliates, sub-contractors, agents and partners are required by contract to safeguard any personal data they receive from us and are prohibited from using the personal data for any purpose other than to perform the services as instructed by Xerox. We also take steps to provide adequate protection for any transfers of your personal data in accordance with applicable law.

74

94

75

95

Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal data from the European Economic Area and Switzerland to other countries. When we do, we use a variety of legal mechanisms, including Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.

76

96

77

97

## Video Links

78

98

79

Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information.

80

[https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)

99

Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)

81

100

82

101

## EU-U.S. Privacy Shield

83

102

84

103

**Commitment to Privacy Shield Principles**. Through November 2020, Xerox Corporation certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, both of which were established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland, respectively, to the United States. The EU-U.S. Privacy Shield was recently invalidated by the Court of Justice of the European Union ("EU Court"). The Swiss-U.S. Privacy Shield remains in place, although for reasons similar to those cited by the EU Court, the Swiss DPA has opined that the U.S. does not provide an adequate level of protection for Swiss citizens. _For more explanation on the adequacy of the protection of personal data transferred from the EU and Switzerland to Xerox in the U.S., see below under the headings "Schrems II" and "Transparency Report."_

85

104

86

105

In anticipation of further developments from EU and Swiss data protection authorities as to a new framework for transfer of personal data of EU data subjects from the EU to the U.S., Xerox continues to comply in practice with the Privacy Principles of the aforementioned Privacy Shield Frameworks. In some cases, we rely on the GDPR Standard Contractual Clauses which contain requirements that are comparable to the Privacy Principles.

+## Xerox Privacy Statement
 ## Introduction
 This privacy statement covers the websites and applications of Xerox Corporation ("Xerox" or "we") that include a link to this statement. This privacy statement also applies to Xerox's marketing and advertising practices where and when it is referenced. It is meant to inform you about our collection and use of your personal data.
 ## Personal Data We Collect
 **Products.** Certain Xerox products collect data, such as product registration, device serial number, meter reads, supply levels, equipment configuration and settings, software version, and fault codes. Xerox uses this information for product improvement, billing, report generation, supplies replenishment and support services.
 **Third Party Sources**. We also obtain data from third-parties. These third-party sources vary over time, but they are sources deemed credible by us and may be publicly available or available on a commercial basis. They can include:
 - Data brokers from which we purchase demographic data to supplement the data we collect;
 - Social networks when you grant permission to a Xerox product to access your data on one or more networks;
 - Designated entities within your business or enterprise (such as a member of your IT department) in the course of providing services to you;
 - Partners with whom we offer branded services or engage in joint marketing activities. If you purchase Xerox services or products from a Xerox partner we may receive certain information about your purchase from that partner;
 - Fraud prevention agencies or credit reporting agencies in connection with credit determinations; and
 - Publicly available sources such as open government databases or other data in the public domain.
 ## How We Use Personal Data
 We collect and process personal data with your consent, as required by law, or as necessary to fulfill the legitimate interests or business purposes of Xerox, including to: (i) provide you with products and services; (ii) manage, administer and operate our business; (iii) meet our contractual and legal obligations; (iv) carry out direct marketing; (v) prevent fraud; and (vi) protect the security of our systems and our customers.
 Xerox uses personal data to:
 - respond to your questions and communicate with you;
 - provide customer support;
 - share news, updates, or helpful tips about Xerox products and services;
 - enable online shopping;
 - inform you of special promotions and other advertising;
 - allow you to sign up for online services;
 - create reseller partnerships;
 - receive and evaluate job applications;
 - customize, analyze, and improve our products, services, technologies, communications and relationships with you;
 - deliver products and services requested by you;
 - notify you about administrative matters that pertain to your Xerox products or services; and
 - in the event of a merger or acquisition of Xerox or a substantial portion of its assets, disclose or transfer personal data to the surviving or acquiring party, respectively.
 Personal data that is submitted in a business capacity may be merged with available business database directories.
 We share your personal data as necessary for Xerox's business purposes, to complete a transaction or provide a product or service you have requested or authorized. For example, when you provide payment data to make a purchase, we will share your payment data with banks and other entities that process payment transactions or provide other financial services, and with consumer reporting agencies for fraud prevention and credit risk reduction.
 We share personal data among Xerox affiliates and subsidiaries to efficiently manage the operation of our business. We also share personal data with vendors or agents working on our behalf for the purposes described in this statement or in our contracts with you. For example, companies we've hired to provide customer service support or assist in maintaining or servicing business accounts or products via our systems and services may need access to personal data to provide those functions. In addition, we may share information with third parties for the joint offering of a product or service. In such cases, these companies are required by contract to abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.
 Finally, we will transfer or disclose personal data when we have a good faith belief that doing so is necessary to:
 - Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;
 - Protect our customers, for example to prevent attempts to defraud users of our products, or to help prevent the loss of life or serious injury of anyone; or
 - Operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.
 We do not sell your personal data to third parties.
 ## Where We Process and Store Personal Data
 Personal data collected by Xerox may be transferred to, stored and processed in your region, the United States, or any other country in which Xerox or its subsidiaries, affiliates, sub-contractors, agents or partners maintain facilities. Our subsidiaries, affiliates, sub-contractors, agents and partners are required by contract to safeguard any personal data they receive from us and are prohibited from using the personal data for any purpose other than to perform the services as instructed by Xerox. We also take steps to provide adequate protection for any transfers of your personal data in accordance with applicable law.
 Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal data from the European Economic Area and Switzerland to other countries. When we do, we use a variety of legal mechanisms, including Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.
 ## Video Links
+Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information.
+[https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)
+Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)
 ## EU-U.S. Privacy Shield
 **Commitment to Privacy Shield Principles**. Through November 2020, Xerox Corporation certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, both of which were established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland, respectively, to the United States. The EU-U.S. Privacy Shield was recently invalidated by the Court of Justice of the European Union ("EU Court"). The Swiss-U.S. Privacy Shield remains in place, although for reasons similar to those cited by the EU Court, the Swiss DPA has opined that the U.S. does not provide an adequate level of protection for Swiss citizens. _For more explanation on the adequacy of the protection of personal data transferred from the EU and Switzerland to Xerox in the U.S., see below under the headings "Schrems II" and "Transparency Report."_
 In anticipation of further developments from EU and Swiss data protection authorities as to a new framework for transfer of personal data of EU data subjects from the EU to the U.S., Xerox continues to comply in practice with the Privacy Principles of the aforementioned Privacy Shield Frameworks. In some cases, we rely on the GDPR Standard Contractual Clauses which contain requirements that are comparable to the Privacy Principles.
 ## Your Privacy Rights
 You have choices about the data we collect. When you are asked to provide personal data, you may decline. However if you choose not to provide data that is necessary to provide a product or feature, you may not be able to use that product or feature.
 - If the processing of personal data is based on your consent, you have a right to withdraw consent at any time for future processing;
 - Where applicable, you have a right to request from us, (i) access to and receipt of personal data, (ii) transfer of personal data, and (iii) rectification or deletion of your personal data;
 - You may also have a right to object to or restrict the processing of your personal data;
 - You have the right to object to direct marketing (you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication); and
 - You have a right to file a complaint with a regulator or data protection authority.
 You may contact Xerox to check the accuracy of your personal data or to request that your information be updated or deleted by writing to [privacy@xerox.com](mailto:privacy@xerox.com). Please indicate "Access" in the subject line and let us know the details of your request in the body of the message. Xerox reserves the right to confirm your identity and to modify the scope and number of requests. In certain cases, your request may be denied on the basis of a legitimate exception or where we are legally prevented from honoring such request.
 ## Children
 Yes, Xerox provides [a tool to opt-out of data collection](http://preferences-mgr.truste.com/) by companies that adhere to the [Self-Regulatory Program for Online Behavioral Advertising](http://www.aboutads.info/principles/).
 ## Communication Preferences
 Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication. You may also mail an unsubscribe request to:
+Marketing Privacy Preferences
+Xerox Corporation
+Marketing Manager
+SW Canyon Creek Road,
+Building 63 MS 7063-630,
+Wilsonville, OR 97070
+Marketing Privacy Preferences Xerox Corporation Marketing Manager 27063 SW Canyon Creek Road, Building 63 MS 7063-630, Wilsonville, OR 97070
 This unsubscribe option does not apply to communications primarily for the purpose of administering order completion, contracts, support, product safety warnings, software updates, or other administrative and transactional notices, the primary purpose of which is not promotional in nature.
 Xerox commits to resolve complaints about your privacy and our collection or use of your personal data.
 To report your inquiries or concerns to the Xerox Business Ethics and Compliance Office please contact the Xerox Ethics Helpline. The Xerox Ethics Helpline is confidential and anonymous, if you so desire, and is available online and via the toll-free number listed below.
 - Web Reporting: [www.xeroxethicshelpline.com](http://www.xeroxethicshelpline.com/)
 - US & Canada Toll-Free Number: 1-866-XRX-0001
 - [Direct Dial Toll-Free Numbers Outside US & Canada](https://www.xerox.com/downloads/usa/en/h/HowtoContacttheXeroxEthicsHelpline.pdf) available at [www.xerox.com/ethics](https://www.xerox.com/en-us/about/corporate-citizenship/ethics)
 You may also contact us via postal mail at:
+Xerox Corporation
+Xerox Business Ethics and Compliance Office
+Merritt 7
+Norwalk, CT 06851-1056
+USA
+Xerox Corporation Xerox Business Ethics and Compliance Office 201 Merritt 7 Norwalk, CT 06851-1056 USA
 Xerox Limited is our representative for the European Economic Area and Switzerland:
 Xerox Limited, Riverview, Oxford Road, Uxbridge, UB8 1HS, UK
 The Xerox subsidiary in your country or region can be found [here](https://www.xerox.com/en-us/about/contact-us).

Xerox Privacy Policy

Full text changes — 20210124_rev01 to 20210516_rev01