Xerox Privacy Policy

20230730_rev01 · COMPARED WITH 20221214_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE

Full text changes — 20221214_rev01 to 20230730_rev01

11## Xerox Privacy Statement
22
3Effective Date: July 1, 2023
4
35## Introduction
46
5This privacy statement covers the websites and applications of Xerox Holdings Corporation ("Xerox" or "we") that include a link to this statement. This privacy statement also applies to Xerox's marketing and advertising practices where and when it is referenced. It is meant to inform you about our collection and use of your personal data.
7This privacy statement describes how Xerox Holdings Corporation and its subsidiaries ("Xerox," "we," "us" or "our") collect, protect, use, and disclose your information, including personal information, when you visit our websites, purchase and use any of our products or services, apply for a job, or otherwise communicate or interact with us including when accessing product and technical support. Please note that Xerox also offers access to third-party applications and services, either as a direct reseller or as a licensor. In such cases, the third-party's privacy policy is the appropriate policy to look to and will usually be referenced directly in that application or service.
68
7## Personal Data We Collect
9## What we mean by "Personal Information"
810
9You may choose to give us personal data to allow us to communicate with you, process your orders, provide you with services, or for employment consideration. Data we collect depends on the context of your interactions with Xerox, the choices you make, including your privacy settings, and the products and features you choose. The personal data we collect can include the following:
11In this Privacy Statement, "personal information" generally means information (regardless of its format) that can be used, either alone or in combination with other information, to identify an individual. This may include, for example, name, contact information, mailing address, email address, purchase history and other information relating to your account with us (as the case may be). It may also include other types of more technical information, but only when this information can identify you as an individual. Information that is anonymized and cannot be associated with an identifiable individual is not considered personal information, if it is, at all times, reasonably foreseeable in the circumstances that this information irreversibly no longer allows the individual to be identified directly or indirectly.
1012
11**Name and Contact Data**. Your first and last name, email address, postal address, phone number and other similar contact data in order to communicate with you, process orders or provide you with products or services. We may also collect your employer name, if you are procuring products or services on behalf of an organization.
13## Personal Information We Collect
1214
13**Credentials**. Passwords, password hints and similar security information used for authentication and account access.
15Xerox collects personal information to allow us to communicate with you, process your orders, support you as customers, potential customers, (including providing you with products and services), conduct marketing, or for employment consideration. We collect personal information when you contact or do business with Xerox, including when you:
1416
15**Demographic Data**. Data about you such as your country of residence and preferred language.
17- Purchase, request support for, or register products or services;
1618
17**Payment Data**. Data necessary to process your payment if you make purchases, such as your payment card number, expiration date, and the security code associated with your payment card.
19- request software downloads;
1820
19**Geolocation Data**. We may collect data about your location, which can be either precise or imprecise. Precise location data can be obtained through Global Navigation Satellite System data, as well as through nearby cell towers and Wi-Fi hotspots when you enable location-based products or features. Imprecise location data includes, for example, a location derived from your device or data that indicates where you are located with less precision, such as an internet protocol (IP) address or a city or postal code.
21- create a user account (login user name and password);
2022
21**Social Media Data.** We may provide social media features that enable you to share information with your social networks. Your use of these features may result in the collection or sharing of information about you by the social networking site. Please review the privacy policies and settings of social networks you use to understand their practices.
23- request information or materials such as documentation, whitepapers, or case studies;
2224
23**Job Applications/CVs/Resumes**. Professional, education and employment-related information on job applications/CVs/resumes which you provide to us if you submit a job application to Xerox either directly or indirectly, which may include sensitive personal data. Xerox uses this information in order to evaluate your application and perform related employment activities.
25- participate in surveys, evaluations, provide feedback, or submit questions or comments to us;
2426
25**Feedback and Product Reviews.** Information you provide to us and the content of messages you send to us, such as feedback and product reviews you write, blog posts or questions and information you provide for customer support. When you contact us via our website, a Xerox application or a Help Desk, such as for customer support, phone conversations or chat sessions with our representatives may be monitored and recorded. Your feedback, posts and reviews will be used to seek improvements in our products and services.
27- participate in promotions, contests, or marketing events;
2628
27**Website Browsing and Commercial Information.** Information about your visits to our websites and your browsing patterns, including inferences drawn from this information. This may include information related to your prior purchases and online buying preferences or data about your device, including IP address, browser type, and regional and language settings. This is more fully described under the section entitled "Cookies, Web Beacons and Privacy Choices" below. We collect this information to determine such things as the number of visitors to various parts of our websites, to personalize your experience on our sites, and tailor our interactions with you.
29- apply for a job or submit your resume.
2830
29**Products.** Certain Xerox products collect data, such as product registration, device serial number, meter reads, supply levels, equipment configuration and settings, software version, and fault codes. Xerox uses this information for product improvement, billing, report generation, supplies replenishment and support services.
31Data we collect depends on the context of your interactions with Xerox, the choices you make, including your privacy settings, and the products and features you choose. The personal information we collect can include the following:
3032
31**Third Party Sources**. We also obtain data from third-parties. These third-party sources vary over time, but they are sources deemed credible by us and may be publicly available or available on a commercial basis. They can include:
33- **Name and Contact Data**. Your first and last name, email address, mailing and/or business postal address, phone number, business or organization name, gender and marital status, and other similar business contact data or employment related information..
3234
33- Data brokers from which we purchase demographic data to supplement the data we collect;
35- **Credentials**. Account username, passwords, password hints and similar security information used for authentication and account access. For some sales and employment purposes as well as identity verification, Xerox may also collect government or personal identifiers.
3436
35- Social networks when you grant permission to a Xerox product to access your data on one or more networks;
37- **Demographic Data**. Data about you such as your country of residence and preferred language.
3638
37- Designated entities within your business or enterprise (such as a member of your IT department) in the course of providing services to you;
39- **Payment Data**. Data necessary to process your payment if you make purchases, such as your payment card number, expiration date, and the security code associated with your payment card.
3840
39- Partners with whom we offer branded services or engage in joint marketing activities. If you purchase Xerox services or products from a Xerox partner we may receive certain information about your purchase from that partner;
41- **Geolocation Data**. We may collect data about your location, which can be either precise or imprecise. Precise location data can be obtained through Global Navigation Satellite System data, as well as through nearby cell towers and Wi-Fi hotspots when you enable location-based products or features. Imprecise location data includes, for example, a location derived from your device or data that indicates where you are located with less precision, such as an internet protocol (IP) address or a city or postal code.
4042
41- Fraud prevention agencies or credit reporting agencies in connection with credit determinations; and
43- **Social Media Data.** We may provide social media features that enable you to share information with your social networks. Your use of these features may result in the collection or sharing of information about you by the social networking site. Please review the privacy policies and settings of social networks you use to understand their practices.
4244
43- Publicly available sources such as open government databases or other data in the public domain.
45- **Job Applications/CVs/Resumes**. Professional, education and employment-related information on job applications/CVs/resumes which you provide to us if you submit a job application to Xerox either directly or indirectly, which may include sensitive (also known as 'special category') personal information. Xerox uses this information to evaluate your application and perform related employment activities. It is also possible that Xerox may, offer you the option of providing sensitive personal information or information about protected classifications, such as your age, gender, race, sexual orientation, or disability, marital or veteran status, at any time with your consent and where permitted by applicable law.
4446
45## How We Use Personal Data
47- **Feedback and Product Reviews.** Information you provide to us and the content of messages you send to us, such as feedback and product reviews you write, blog posts or questions and information you provide for customer support. When you contact us via our website, a Xerox application or through a Xerox help desk or support call, phone conversations or chat sessions with our representatives may be monitored and recorded. Your feedback, posts and reviews will be used to seek improvements in our products and services.
4648
47We collect and process personal data with your consent, as required by law, or as necessary to fulfill the legitimate interests or business purposes of Xerox, including to: (i) provide you with products and services; (ii) manage, administer and operate our business; (iii) meet our contractual and legal obligations; (iv) carry out direct marketing; (v) prevent fraud; and (vi) protect the security of our systems and our customers.
49- **WebsiteBrowsing and Commercial Information.** Information about your visits to our websites and your browsing patterns, including inferences drawn from this information. This may include information related to your prior purchases and online buying preferences or data about your device, including IP address, browser type, and regional and language settings. This is more fully described under the section entitled "Cookies, Web Beacons and Similar Technologies" below. We collect this information to determine such things as the number of visitors to various parts of our websites, to personalize your experience on our sites, and tailor our interactions with you.
4850
49Xerox uses personal data to:
51- **Products and Device Data.** Certain Xerox products and services collect data, such as product registration, device serial number, IP address, MAC address and other unique device identifiers, meter reads, supply levels, equipment configuration and settings, software version, and fault codes. Xerox uses this information for product improvement, billing, report generation, supplies replenishment and support services.
5052
53- **Third Party Sources**. We also obtain data from third parties. These third-party sources vary over time, but they are sources deemed credible by us and may be publicly available or available on a commercial basis. They can include:
54
55 - Data brokers from which we purchase demographic data to supplement the data we collect;
56
57 - Social networks when you grant permission to Xerox or a Xerox product to access your data on one or more networks;
58
59 - Designated entities within your business or enterprise (such as a member of your IT department) in the course of providing services to you;
60
61 - Partners with whom we offer branded services or engage in joint marketing activities. If you purchase Xerox services or products from a Xerox partner, we may receive certain information about your purchase from that partner;
62
63 - Fraud prevention agencies or credit reporting agencies in connection with credit determinations; and
64
65 - Publicly available sources such as open government databases or other data in the public domain.
66
67## How We Use Personal Information
68
69Xerox uses personal information to:
70
5171- respond to your questions and communicate with you;
5272
5373- provide customer support;
5474
5575- share news, updates, or helpful tips about Xerox products and services;
5676
6585- receive and evaluate job applications;
6686
6787- customize, analyze, and improve our products, services, technologies, communications and relationships with you;
6888
6989- deliver products and services requested by you;
7090
71- notify you about administrative matters that pertain to your Xerox products or services; and
91- prevent fraud and protect the security of our systems and our customers;
7292
73- in the event of a merger or acquisition of Xerox or a substantial portion of its assets, disclose or transfer personal data to the surviving or acquiring party, respectively.
93- meet our contractual and legal obligations; and
7494
75Personal data that is submitted in a business capacity may be merged with available business database directories.
95- notify you about administrative matters that pertain to your Xerox products or services.
7696
77We share your personal data as necessary for Xerox's business purposes, to complete a transaction or provide a product or service you have requested or authorized. For example, when you provide payment data to make a purchase, we will share your payment data with banks and other entities that process payment transactions or provide other financial services, and with consumer reporting agencies for fraud prevention and credit risk reduction.
97You may opt out of receiving any, or all, of marketing communications from us by following the unsubscribe link or instructions provided in any commercial electronic message we send or by contacting us directly at the address indicated under "Communication Preferences".
7898
79We share personal data among Xerox affiliates and subsidiaries to efficiently manage the operation of our business. We also share personal data with vendors or agents working on our behalf for the purposes described in this statement or in our contracts with you. For example, companies we've hired to provide customer service support or assist in maintaining or servicing business accounts or products via our systems and services may need access to personal data to provide those functions. In addition, we may share information with third parties for the joint offering of a product or service. In such cases, these companies are required by contract to abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets.
99## How We Share or Disclose Personal Information
80100
81Finally, we will transfer or disclose personal data when we have a good faith belief that doing so is necessary to:
101We may share or disclose your personal information as necessary for the following legitimate business purposes of Xerox or otherwise with your consent or as permitted or required by law:
82102
103- To complete a transaction or provide a product or service you have requested or authorized. For example, when you provide payment data to make a purchase, we will share your payment data with banks and other entities that process payment transactions or provide other financial services, and with consumer reporting agencies for fraud prevention and credit risk reduction. In addition, we may share information with third parties for the joint offering of a product or service.
104
105- We share personal information among our subsidiaries, affiliates, agents, or partners, who fulfill the orders or provide the services and to efficiently manage the operation of our business. Xerox requires that its subsidiaries, affiliates, agents, and partners handle personal information with the same protections for personal information privacy as Xerox.
106
107- We share personal information with vendors, service providers, or agents working on our behalf for the purposes described in this Statement or in our contracts with you. Vendors and service providers who may need to access personal information include companies we've hired to provide customer service support, assist in maintaining or servicing business accounts or products via our systems and services, to assistant with development of products, or support our business functions and internal operations including: fulfilling orders, delivering and installing products, invoice and payment processing, investigating fraudulent activity, conducting customer surveys, providing marketing assistance, providing IT software and maintenance services, or providing archiving services.
108
109- We may also disclose personal information when required in the context of a prospective or completed business transaction, such as the event of a merger or acquisition of Xerox or a substantial portion of its assets, in accordance with applicable legal requirements.
110
111When we share your personal information with third party companies, we make sure they are required by contract to abide by data privacy and security requirements and are not allowed to use personal information they receive from us for any other purpose. We do not sell your personal information to third parties.
112
113We may also disclose personal information when we have a good faith belief that doing so is necessary to:
114
83115- Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;
84116
85117- Protect our customers, for example to prevent attempts to defraud users of our products, or to help prevent the loss of life or serious injury of anyone; or
86118
87119- Operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.
88120
89We do not sell your personal data to third parties.
121## Grounds for Processing Your Information
90122
91## Where We Process and Store Personal Data
123We collect and process personal information with your consent, as required by law, or as necessary to fulfill the legitimate interests or business purposes of Xerox, including to: (i) provide you with products and services; (ii) manage, administer and operate our business; (iii) meet our contractual and legal obligations; (iv) carry out direct marketing; (v) prevent fraud; and (vi) protect the security of our systems and our customers.
92124
93Personal data collected by Xerox may be transferred to, stored and processed in your region, the United States, or any other country in which Xerox or its subsidiaries, affiliates, sub-contractors, agents or partners maintain facilities. Our subsidiaries, affiliates, sub-contractors, agents and partners are required by contract to safeguard any personal data they receive from us and are prohibited from using the personal data for any purpose other than to perform the services as instructed by Xerox. We also take steps to provide adequate protection for any transfers of your personal data in accordance with applicable law.
125## Where We Process and Store Personal Information
94126
95Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that the data we collect under this privacy statement is processed according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal data from the European Economic Area and Switzerland to other countries. When we do, we use a variety of legal mechanisms, including Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.
127Personal information collected by Xerox may be transferred to, stored, or processed in your region, in the United States, or in any other country in which Xerox or its subsidiaries, affiliates, sub-contractors, agents or partners operate. As a result, when your personal information is used or stored in a jurisdiction other than where you are residing, it may be subject to the law of this foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts, and law enforcement in that jurisdiction.
96128
129Our subsidiaries, affiliates, sub-contractors, agents and partners are required to safeguard any personal information they receive from us and are prohibited from using the personal information for any purpose other than to perform the services as instructed by Xerox. We also take steps to provide adequate protection for any transfers of your personal information in accordance with applicable law.
130
131Our privacy guidelines are communicated to Xerox employees on an annual basis as part of our mandatory training program. We take steps to ensure that we collect and process personal information according to the provisions of this statement and the requirements of applicable law wherever the data is located. Sometimes we transfer personal information from the European Economic Area, Switzerland, and the United Kingdom to other countries. When we do, we use a variety of legal mechanisms, including, as appropriate, Standard Contractual Clauses, to help ensure any required rights and protections apply to your data.
132
97133## Video Links
98134
99Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology (e.g.,[YouTube](https://www.youtube.com/static), [YouTube API](https://www.youtube.com/t/terms), or another third party site). In any such case, by playing the video you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms)
135Clicking on videos on Xerox.com may (1) take you to a third party's site to play the video, or (2) play the video on Xerox.com and this functionality may be supported by a third party's site or technology. In any such case, by playing the video you are using a third-party site and will be subject to that third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. (e.g., [https://www.youtube.com/t/terms](https://www.youtube.com/t/terms))
100136
101137## Applications
102138
139**Google Drive**
140
103141Use of **Print from Google Drive** or **Scan to Google Drive (each an "Application" and together the "Applications")** may take you to your Google Drive. Your Google Drive is a third party site and Xerox has no control over the privacy policies or terms of use of that site. The Applications present you with Google Drive login screens, so that you enter your credentials directly into Google. The Applications display your Google Drive content directory (file and folder names). The **Print from Google Drive** application will temporarily download a selected file, submit it to the device for printing, then delete the file after printing. The Applications do not store your credentials. By using the Applications, you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information. Read more about how Google uses your information [**here**](https://www.google.com/policies/privacy/partners/).
104142
105## EU-U.S. Privacy Shield
143**Other Third-Party Services**
106144
107**Commitment to Privacy Shield Principles**. Through November 2020, Xerox Corporation certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, both of which were established by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland, respectively, to the United States. The EU-U.S. Privacy Shield was recently invalidated by the Court of Justice of the European Union ("EU Court"). The Swiss-U.S. Privacy Shield remains in place, although for reasons similar to those cited by the EU Court, the Swiss DPA has opined that the U.S. does not provide an adequate level of protection for Swiss citizens. _For more explanation on the adequacy of the protection of personal data transferred from the EU and Switzerland to Xerox in the U.S., see below under the headings "Schrems II" and "Transparency Report."_
145A number of Xerox services permit you to connect to third-party services such as DropBox, Box and Office365 and although such credentials may be temporarily retained within either a device or application at the user's discretion and for their convenience, Xerox itself does not collect or centrally store such third-party credentials. By using the Applications, you may become subject to the third party's terms and conditions, including, but not limited to, its terms of service and policies on privacy and collection and use of your information.
108146
109In anticipation of further developments from EU and Swiss data protection authorities as to a new framework for transfer of personal data of EU data subjects from the EU to the U.S., Xerox continues to comply in practice with the Privacy Principles of the aforementioned Privacy Shield Frameworks. In some cases, we rely on the GDPR Standard Contractual Clauses which contain requirements that are comparable to the Privacy Principles.
147**Transparency Report**.
110148
111Consistent with its commitment to the Privacy Principles, if third party agents process personal data on Xerox's behalf in a manner inconsistent with the Privacy Shield Principles, we remain liable unless we prove we are not responsible for the event giving rise to the damage. If there is any conflict between the terms in this privacy statement and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
149To the best of its knowledge, Xerox Holdings Corporation has never received or responded to any national surveillance subpoena or warrant under FISA or EO 12333. Based on this history and Xerox's continued commitment to adhere to the privacy principles, EU and Swiss data subjects and our customers may have reasonable assurance that (1) Xerox Holdings Corporation is unlikely to receive a FISA or EO 12333 subpoena or warrant targeting the personal data of an EU or Swiss citizen, and therefore the concerns cited by the EU Court in _Schrems II_ are unlikely to be implicated as to such personal data transferred to Xerox in the U.S., and (2) the personal data transferred to Xerox in the U.S. and the rights of EU and Swiss citizens are adequately protected consistent with the requirements of GDPR and the Swiss FADP.
112150
113Similarly, Xerox continues its commitment to resolving complaints about our collection or use of personal data. EU and Swiss data subjects with inquiries or complaints regarding this privacy statement or Xerox's collection or use of their personal data should first contact Xerox at: [privacy@xerox.com](mailto:privacy@xerox.com) and indicate "Privacy Shield Query" in the Subject line.
151## Period of Storage
114152
115Xerox also commits to cooperate with the panel established by the EU data protection authorities or the Swiss Federal Data Protection and Information Commissioner, as applicable, and to comply with the advice given by the panel or commissioner with regard to data transferred from the EU or Switzerland. Data subjects may also be able, under certain conditions, to invoke binding arbitration.
153Xerox retains personal information for as long as necessary for the purposes described in this Statement, including to provide the products and fulfill the services and transactions you have requested or for other essential purposes and when required or authorized by law. Actual retention periods can vary. The criteria used to determine the retention periods include: (i) how long personal information is needed to provide our products or operate our business; (ii) whether the personal information is of a sensitive type; and (iii) whether Xerox is subject to a legal, contractual, or similar obligation to retain the data.
116154
117The U.S. Federal Trade Commission has jurisdiction over Xerox's compliance with the Privacy Shield.
155## Your Choices and Privacy Rights
118156
119**Schrems II**. Xerox is aware of the July 2020 _Schrems II_ decision of the EU Court that invalidated the EU-U.S. Privacy Shield Framework, and the subsequent opinion of the Swiss DPA regarding the adequacy of the Swiss-U.S. Privacy Shield Framework. As stated above, Xerox continues to adhere to the Privacy Principles in its collection, use and retention of the personal data of EU and Swiss data subjects and to provide adequate security and protection for such data subjects and their personal data that is transferred to it in the U.S.
157You have choices regarding how Xerox processes your personal information. When you are asked to provide personal information, you may decline. However, if you choose not to provide information that is necessary to provide a product, service, or feature, we may not be able to provide you that product, service, or feature. In particular, you may exercise the following choices:
120158
121The primary basis for the EU Court's decision in _Schrems II_ was its opinion that even taking into account the protections afforded by the EU-U.S. Privacy Shield, national security surveillance conducted by the U.S. federal government can take place without adequate protections for EU data subjects. The two specific authorities upon which the EU Court based its decision are §7022 of the Foreign Intelligence Surveillance Act ("FISA") and Executive Order 12333 ("EO 12333"). Pursuant to these authorities, the U.S. government may obtain secret subpoenas or warrants, the targets of which may include EU data subjects.
159- If the collection and/or processing of personal information is based on your consent, you have a right to withdraw consent at any time for future processing, subject to contractual and legal restrictions;
122160
123**Transparency Report**. To the best of its knowledge, Xerox Holdings Corporation has never received or responded to any national surveillance subpoena or warrant under FISA or EO 12333. Based on this history and Xerox's continued commitment to adhere to the Privacy Principles, EU and Swiss data subjects and our customers may have reasonable assurance that (1) Xerox Holdings Corporation is unlikely to receive a FISA or EO 12333 subpoena or warrant targeting the personal data of an EU or Swiss citizen, and therefore the concerns cited by the EU Court in _Schrems II_ are unlikely to be implicated as to such personal data transferred to Xerox in the U.S., and (2) the personal data transferred to Xerox in the U.S. and the rights of EU and Swiss citizens are adequately protected consistent with the requirements of GDPR and the Swiss FADP.
161- Where applicable, you have a right to request from us, (i) access to and receipt of personal information, (ii) transfer of personal information, and (iii) rectification or deletion of your personal information;
124162
125## Period of Storage
163- You may also have a right to object to or restrict the processing of your personal information;
126164
127Xerox retains personal data for as long as necessary to provide the products and fulfill the services and transactions you have requested or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements. Actual retention periods can vary. The criteria used to determine the retention periods include: (i) how long personal data is needed to provide our products or operate our business; (ii) whether the personal data is of a sensitive type; and (iii) whether Xerox is subject to a legal, contractual or similar obligation to retain the data.
165- You have the right to object to direct marketing as explained in more details below in "Communication Preferences" (you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication); and
128166
129## Your Privacy Rights
167- You have a right to file a complaint with a regulator or data protection authority.
130168
131You have choices about the data we collect. When you are asked to provide personal data, you may decline. However if you choose not to provide data that is necessary to provide a product or feature, you may not be able to use that product or feature.
169You may contact Xerox to check the accuracy of your personal information or to request that your information be updated or deleted by writing to [privacy@xerox.com](mailto:privacy@xerox.com). Please indicate "Access" in the subject line and let us know the details of your request in the body of the message. Xerox reserves the right to confirm your identity and to modify the scope and number of requests. In certain cases, your request may be denied on the basis of a legitimate exception or where we are legally prevented from honoring such request. Your rights to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information may be limited in some circumstances by applicable law.
132170
133- If the processing of personal data is based on your consent, you have a right to withdraw consent at any time for future processing;
171## Minors
134172
135- Where applicable, you have a right to request from us, (i) access to and receipt of personal data, (ii) transfer of personal data, and (iii) rectification or deletion of your personal data;
173Xerox does not direct any part of its website to children under 16 years old (or such age as a child is defined by local law if higher) and does not knowingly collect personal information from children or target its website or products to children. If we learn we have collected or received personal information from a child under 16 years old without verification of parental consent, we will delete the information.
136174
137- You may also have a right to object to or restrict the processing of your personal data;
175## Security of Personal Information
138176
139- You have the right to object to direct marketing (you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication); and
177Xerox is committed to protecting the security of your personal information and maintains strict access control over it. We utilize reasonable security procedures and practices and appropriate, technical and organizational measures to safeguard the personal information we collect and process against any unauthorized access, use, disclosure, loss or theft of personal information. To ensure that you can purchase with confidence from Xerox websites, Xerox protects credit card information submitted online with industry-standard encryption technology or tokenization.
140178
141- You have a right to file a complaint with a regulator or data protection authority.
179## Data Governance Measures
142180
143You may contact Xerox to check the accuracy of your personal data or to request that your information be updated or deleted by writing to [privacy@xerox.com](mailto:privacy@xerox.com). Please indicate "Access" in the subject line and let us know the details of your request in the body of the message. Xerox reserves the right to confirm your identity and to modify the scope and number of requests. In certain cases, your request may be denied on the basis of a legitimate exception or where we are legally prevented from honoring such request.
181Xerox maintains policies and practices to ensure the protection of your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information, including:
144182
145## Children
183- Internal policies and procedures that define the roles and responsibilities of our employees throughout the information life cycle and limits their access to such information on a "need-to-know" basis;
146184
147Xerox does not direct any part of its website to children under 13 years old (or such age as a child is defined by local law if higher) and does not knowingly collect personal data from children or target its website or products to children. If we learn we have collected or received personal data from a child under 13 years old without verification of parental consent, we will delete the information.
185- Technical safeguards such as encryption, firewalls, antivirus software and similar measures to protect information stored in electronic format;
148186
149## Security of Personal Data
187- A designated Privacy Officer to monitor our compliance with applicable privacy laws;
150188
151Xerox is committed to protecting the security of your personal data and maintains strict access control over it. We utilize reasonable and appropriate physical, technical and administrative procedures to safeguard personal information we collect and process. Only authorized Xerox personnel, and those of our subsidiaries, affiliates, agents, and partners are allowed to handle information collected by Xerox.
189- Employee privacy and data security training;
152190
153Xerox websites store personal data in password-protected environments on servers that are subject to Xerox's information security policies, standards, and procedures. We use a variety of security technologies and procedures to help protect your personal data from unauthorized access, use or disclosure. For example, we store the personal data you provide on computer systems that have limited access and are in controlled facilities. When we transmit sensitive personal data such as a password over the Internet, we protect it through the use of encryption.
191- Procedures for receiving, investigating and responding to complaints or inquiries regarding Xerox's information handling practices, including any security incidents involving personal information; and
154192
155To ensure that you can purchase with confidence from Xerox websites, Xerox protects credit card information submitted online with industry-standard encryption technology or tokenization.
193- A Framework governing the retention and destruction of personal information.
156194
157## Our Agents and Partners Protect Personal Data
195## Cookies, Web Beacon and Similar Technologies
158196
159When you provide personal data to Xerox, it may be necessary to transfer personal data to our subsidiaries, affiliates, agents or partners, who then fulfill the orders or provide the services. Xerox requires that its subsidiaries, affiliates, agents and partners handle personal data with the same concern for personal data privacy as Xerox.
197Xerox use cookies and similar technologies to enhance your experience when accessing its websites and applications for the reasons described above, including to provide you with support and services and to conduct marketing. We use cookies to allow us to personalize your experience, and compile statistics about how the websites are used, including the most popular pages. Xerox also uses pixels (clear GIFs and web beacons) to track the actions of users of our websites and email recipients, measure the success of our marketing campaigns, track whether our emails are forwarded, and compile statistics about usage of our websites and email response rates.
160198
161## Cookies, Web Beacons and Privacy Choices
199Xerox also uses Google Analytics and similar web analytics services which use cookies and similar technologies to collect and analyze information about the use of services and report on activities and trends. You can learn about Google's practices [here](https://policies.google.com/technologies/partner-sites).
162200
163201**What is a Cookie?**
164202
165Cookies are small text files that are placed on your computer or mobile device by websites that you visit. They are widely used in order to make websites work efficiently, as well as to provide information to the owners of the site. Cookies are useful because they allow a website to recognize your device, letting you navigate between pages efficiently, remembering your preferences, and generally improving your experience.
203Cookies are small files that are placed on your computer or mobile device by websites that you visit. Your browser saves cookies in a designated file for cookies on your computer or device. They are widely used in order to make websites work efficiently, as well as to provide information to the owners of the site. Cookies are useful because they allow a website to recognise your device, letting you navigate between pages efficiently, remembering your preferences, and generally improving your experience.
166204
167205**How Does Xerox Use Cookies?**
168206
169Xerox uses cookies to recognize repeat visits to our websites and to facilitate Web navigation and online shopping. The cookies store your country and language, along with an assigned random session ID. In some cases, the cookies store name and address information so you do not have to re-enter this information in multiple forms.
207Xerox uses cookies to recognise repeat visits to our websites and to facilitate Web navigation and online shopping. The cookies store your country and language, along with an assigned random session ID. In some cases, the cookies store name and address information so you do not have to re-enter this information in multiple forms.
170208
171The cookie information that Xerox collects helps us track the number of visitors to our websites over time and determine whether these were new or repeat visits.
209The cookie information that Xerox collects helps us track the number of visitors to our websites over time and determine whether these were new or repeat visits. Xerox also works with third party advertising partners that use cookies to deliver Xerox advertising on other websites and to measure the performance of our advertising campaigns. For example, we use Google Analytics to track website usage and activity. Read more about how Google Analytics uses your information [here](https://www.google.com/policies/privacy/partners/).
172210
173Xerox also works with third party advertising partners that use cookies to deliver Xerox advertising on other websites and to measure the performance of our advertising campaigns. For example, we use Google Analytics to track website usage and activity. Read more about how Google Analytics uses your information [here](https://www.google.com/policies/privacy/partners/).
174
175211**What is a Web Beacon?**
176212
177A web beacon is an electronic image that can be used to recognize a cookie on your computer or other device when you view a web page or email.
213A web beacon is an electronic image that can be used to recognise a cookie on your computer or other device when you view a web page or email.
178214
179215**How Does Xerox Use Web Beacons?**
180216
181217Xerox and our third party advertising partners may use web beacons on our websites, in our emails, and in our advertisements on other websites to measure the effectiveness of our websites and our advertising. For example, web beacons may count the number of individuals who visit our websites from a particular advertisement or the number of individuals who open or act upon an email message.
182218
183219**Can I Block Cookies and Web Beacons?**
184220
185Yes, the ability to enable, disable or delete cookies can be controlled though your website browser. Consult the "Help" menu of your browser application for details. If you block the use of cookies, you will not be able to use some of the features on Xerox websites, including the shopping cart and online account management services. You can make some web beacons unusable by disabling cookies.
221Yes, the ability to enable, disable or delete cookies can be controlled though your website browser. Consult the "Help" menu of your browser application for details. If you block the use of cookies, you will not be able to use some of the features on Xerox websites, including the shopping cart and online account management services. You can make some web beacons unusable by disabling cookies. In addition Xerox provides [a tool to opt-out of data collection](http://preferences-mgr.truste.com/) by companies.
186222
223We do not currently respond to do-not-track signals. If you do not want information collected through the use of cookies, most browsers allow you to automatically decline cookies or be given the choice of declining or accepting a particular cookie (or cookies) from a particular website. You can review https://www.allaboutcookies.org for more information. Please note, that if you do not accept cookies, you may experience some inconvenience in your use of our websites.
224
187225**Links to Non-Xerox Websites.**
188226
189Other websites that may be accessed through our website, such as through social media buttons or other links, may collect certain information about you through the use of cookies, web beacons and other features. We do not have access to or control over the cookies or other features that these third party sites may use, and the information practices of these third party websites are not covered by this privacy statement. Please review the privacy notices and settings of the third party site to understand their practices.
227Other websites may be accessed through our website, such as through social media buttons or other links. These third-party websites may collect certain information about you through the use of cookies, web beacons and other features. We do not have access to or control over the privacy practices or the content of these websites or the cookies or other features that these third-party sites may use. We are not responsible for the content or the information practices of these third-party websites, and such websites are not covered by this privacy statement. We encourage you to review the privacy notices and terms of use when visiting any of the third-party sites to understand their practices.
190228
191229**Privacy Choices: How Does Xerox Use Interest-Based Advertising?**
192230
193Websites cooperate with online advertisers to collect information about visitors to present ads that are more useful and relevant. This is known as interest-based advertising or online behavioral advertising. Xerox and our third party advertising partners may use cookies and web beacons to deliver interest-based ads that are relevant and targeted to our customers and prospects. When delivering interest-based ads, Xerox adheres to the Self-Regulatory Program for Online Behavioral Advertising.
231Websites cooperate with online advertisers to collect information about visitors to present ads that are more useful and relevant. This is known as interest-based advertising or online behavioral advertising. Xerox and our third party advertising partners may use cookies and similar technologies to deliver interest-based ads that are relevant and targeted to our customers and prospects.
194232
195233**What Information Do Xerox Websites Collect for Interest-Based Advertising?**
196234
197Xerox and our third party advertising partners may use cookies or web beacons to collect information for the purposes of interest-based advertising based on your visits to Xerox.com and other web sites. These cookies identify the pages you view, the links and ads you click on, other actions you take on those websites, and the referring website. Similarly, online advertisers use cookies to deliver advertising to you for companies other than Xerox based on your visits to Xerox.com and other websites.
235Xerox and our third party advertising partners may use cookies or web beacons to collect information for the purposes of interest-based advertising based on your visits to Xerox.com and other web sites. These cookies identify the pages you view, the links and ads you click on, other actions you take on those websites, and the referring website. Similarly, online advertisers may use cookies to deliver advertising to you for companies other than Xerox based on your visits to Xerox.com and other websites.
198236
199**Can I Control the Interest-Based Advertising that Xerox Websites Collect About Me?** Yes, Xerox provides [a tool to opt-out of data collection](http://preferences-mgr.truste.com/).
200
201237## Communication Preferences
202238
203Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe) or via an 'opt-out' provided in the communication. You may also mail an unsubscribe request to:
239Xerox may send commercial email to you advertising our products and services. You can also subscribe to various product and service-specific communications on our websites. If you receive commercial email from Xerox and wish to discontinue these mailings, you may unsubscribe at [www.xerox.com/unsubscribe](https://www.xerox.com/unsubscribe),via an 'opt-out' provided in the communication, or by communicating with us using the contact details under "Contact Xerox" below. You may also mail an unsubscribe request to:
204240
205Marketing Privacy Preferences Xerox Holdings Corporation Marketing Manager 27063 SW Canyon Creek Road, Building 63 MS 7063-630, Wilsonville, OR 97070
241Marketing Privacy Preferences Xerox Holdings Corporation Marketing Manager, 27063 SW Canyon Creek Road, Building 63 MS 7063-630, Wilsonville, OR 97070
206242
207243This unsubscribe option does not apply to communications primarily for the purpose of administering order completion, contracts, support, product safety warnings, software updates, or other administrative and transactional notices, the primary purpose of which is not promotional in nature.
208244
209Xerox commits to resolve complaints about your privacy and our collection or use of your personal data.
245**Additional Information Regarding the EEA**
210246
211To report your inquiries or concerns to the Xerox Business Ethics and Compliance Office please contact the Xerox Ethics Helpline. The Xerox Ethics Helpline is confidential and anonymous, if you so desire, and is available online and via the toll-free number listed below.
247You can lodge a complaint with the data protection authority for your country or region, or where the alleged infringement of applicable data protection law occurs. However, before doing so, we encourage you to contact us directly to give us an opportunity to work directly with you to resolve any concerns about your privacy.
212248
213- Web Reporting: [www.xeroxethicshelpline.com](https://www.xeroxethicshelpline.com/)
249## Contact Xerox
214250
215- US & Canada Toll-Free Number: 1-866-XRX-0001
251Xerox commits to resolve complaints about your privacy and our collection or use of your personal information.
216252
217- [Direct Dial Toll-Free Numbers Outside US & Canada](https://www.xerox.com/downloads/world/h/How_to_Contact_the_Xerox_Ethics_Helpline_English.pdf) available at [www.xerox.com/ethics](https://www.xerox.com/en-us/about/corporate-social-responsibility/ethics)
253To report your inquiries or concerns to the Xerox Business Ethics and Compliance Office please contact the Xerox Ethics Helpline. The Xerox Ethics Helpline is confidential and anonymous, if you so desire, and is available online and via the toll-free number listed below.
218254
255Web Reporting: [www.xeroxethicshelpline.com](https://www.xeroxethicshelpline.com/) US & Canada Toll-Free Number: 1-866-XRX-0001 [Direct Dial Toll-Free Numbers Outside US & Canada](https://www.xerox.com/downloads/world/h/How_to_Contact_the_Xerox_Ethics_Helpline_English.pdf) available at [www.xerox.com/ethics](https://www.xerox.com/en-us/about/corporate-citizenship/ethics)
256
219257You may also contact us via postal mail at:
220258
221Xerox Holdings Corporation Xerox Business Ethics and Compliance Office 201 Merritt 7 Norwalk, CT 06851-1056 USA
259Xerox Holdings Corporation Xerox Business Ethics and Compliance Office 201 Merritt 7, Norwalk, CT 06851-1056 USA
222260
223261Xerox Limited is our representative for the European Economic Area and Switzerland:
224262
225Xerox Limited, Riverview, Oxford Road, Uxbridge, UB8 1HS, UK
263Xerox Limited, Building 4, Uxbridge Business Park, Sanderson Road, Uxbridge, UB8 1DH, UK
226264
227265The Xerox subsidiary in your country or region can be found [here](https://www.xerox.com/en-us/about/contact-us).
228266
229If you have questions about Xerox products or services, call us toll-free at 1-800-ASK-XEROX or 1-800-275-9376. More contact information is available on [www.xerox.com](https://www.xerox.com/en-us) if you have questions about support, sales, corporate information, scholarships, research and innovation, or services.
267To contact the Xerox Corporation Chief Privacy Officer, please use the following address: [privacy@xerox.com](mailto:privacy@xerox.com)
230268
269To contact Xerox Chief Privacy Officer in Canada, please use the following address: [can-privacy@xerox.com](mailto:can-privacy@xerox.com).
270
271If you have questions about Xerox products or services, call us toll-free at [1-800-ASK-XEROX](tel:1-800-275-9376) or [1-800-275-9376](tel:1-800-275-9376).
272
273More contact information is available on [www.xerox.com](https://www.xerox.com/index/enus.html) if you have questions about support, sales, corporate information, scholarships, research and innovation, or services.
274
231275## Statement Updates
232276
233Xerox reserves the right to make changes to this statement. If we make changes, we will revise this privacy statement to reflect such changes and revise the effective date of the statement.
277Xerox may update this Privacy Policy from time to time. When we do, we will post the current version on this site, and we will revise the version date located at the top of this page. Any changes become effective when we post the revised Privacy Policy. If the changes we make are significant, we will provide a more prominent notice when required by applicable laws. Your continued use of our services following these changes means that you accept the revised Privacy Policy. Prior versions of this policy can be found here: [Xerox Privacy Statement Effective Date: December 24, 2020](https://www.xerox.com/en-us/about/privacy-policy-archive)
234278
235Statement Effective Date: December 24, 2020.
279## Additional information regarding California
236280
237**What Was Revised in this Update?**
281California Consumer Privacy Act of 2018 (CCPA)
238282
239The section of this privacy statement entitled "EU-U.S. Privacy Shield" has been updated to describe Xerox's current practices as to the transfer of personal data of EU and Swiss data subjects, to address concerns raised by the recent decision of the Court of Justice of the European Union in Schrems II, and to add a Transparency Report.
283Pursuant to the CCPA, we are providing the following additional details regarding the categories of Personal Information about California residents that we collected and disclosed in the preceding 12 months.
284
285We collect the following information:
286
287<table><tbody><tr><td><p><strong>Category of Personal Information:</strong></p></td><td><p><strong>Business Purpose:</strong></p></td></tr><tr><td><p><strong>Audio, electronic, visual, thermal, olfactory, or similar information</strong></p></td><td><p>Audio/Visual - where required for regulatory reasons; to keep record of customer instructions or other matters discussed; internal research for technological development and demonstration; helping ensure security &nbsp;</p></td></tr><tr><td><p><strong>Identifiers </strong>such as real name, alias, IP address, email address, account name, unique online identifier, social security number, driver's license number, passport number, or other similar identifiers.</p></td><td rowspan="3"><p>To provide business services and support, and to respond to inquiries; to manage our business operations and administer our customer relationships; to provide relevant marketing to you or your employer; to address compliance and legal obligations (e.g., checking identity of new customers, prevention of fraud/money laundering, to protect the security of our networks, devices, and information); mandatory disclosures and legal claims (e.g., to comply with any subpoena, court order or other legal process or to comply with any regulatory, governmental or legally binding request)</p></td></tr><tr><td><p><strong>Personal Information Categories from Cal. Civ. Code §1798.80(e)</strong>including name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information."</p><p>*"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.</p></td></tr><tr><td><p><strong>Commercial Information</strong> including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.</p></td></tr><tr><td><p><strong>Characteristics of Protected Classifications under California or Federal Law</strong> Race, age, national origin, disability, sex, veteran status, philosophical or religious beliefs, sexual orientation, disability, gender identity, gender expression, marital status, familial status</p></td><td><p>Only as strictly necessary for the purposes identified above; solely to the extent required to comply with Xerox's legal or other best practice obligations (e.g., export controls, anti-money laundering, equality laws, monitoring diversity and inclusion, etc.)</p></td></tr><tr><td><p><strong>Inferences Drawn from any of the PI identified above</strong></p></td><td><p>We may draw inferences from information that we have received (such as, we may draw inferences from evidence received from or on behalf of our customers; we may conclude that you are interested in receiving updates from us on new products, offerings and sales if you have attended company sponsored events or have purchased or expressed an interest in purchasing our products or services; or we may conclude that applicable laws prohibit us from engaging with a prospective customer based on information obtained through our compliance procedures)</p></td></tr><tr><td><p><strong>Professional or employment-related information</strong></p></td><td><p>To provide relevant marketing to you (e.g., information about offerings, services or events that may be of interest); to provide business services and to respond to inquiries;</p></td></tr><tr><td><p><strong>Internet or other electronic network activity information</strong> including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement</p></td><td><p>To make our website more intuitive; to protect the security of our networks, devices, and information; to provide relevant marketing to you</p></td></tr></tbody></table>
288
289**Personal Information listed above is collected from the following categories of sources:**
290
291- Conference calls and video conferences with customers, vendors, resellers, and other third parties;
292
293- Interviews with customers as part of customer feedback program; video surveillance when visiting a Xerox office; voicemail messages; audio and/or video recordings of interviews, presentations, or support calls;
294
295- Directly from individual and corporate customers, affiliates, vendors and counterparties to transactions or disputes,
296
297- Agents or professional advisors authorized to disclose data on behalf of the individual; publicly available or subscription-based sources
298
299- From use our products and services or from activity on our websites or access to our applications.
300
301**We may use or disclose the personal information we collect for one or more of the following purposes:**
302
303- To provide you with information, support, or services that you request from us, including to deliver products and services you purchased, provide customer support, investigate and address your concerns and monitor and improve our responses. We may also save your information to prevent transactional fraud or facilitate new product orders or process returns.
304
305- To create, maintain, customize, and secure your account with us.
306
307- To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you.
308
309- To carry out our obligations and enforce our rights arising from any contracts entered between you and us, including to deliver products and services to you and for billing and collections.
310
311- To help maintain the safety, security, and integrity of our websites, products and services, databases and other technology assets, and business.
312
313- To deliver content and product and service offerings relevant to your interests, including targeted offers and ads through third-party sites, and via email message (with your consent, where required by law).
314
315- For testing, research, analysis and product support and development, including to support, personalize, develop, and improve our website, products, and services.
316
317- As necessary or appropriate to protect the rights, property or safety of us, our customers, or others.
318
319- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
320
321- As described to you when collecting your personal information or to fulfill or meet the reason you provided the information.
322
323- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
324
325**Disclosure of Personal Information**
326
327We may disclose your personal information for a business purpose with the following categories of third parties: our affiliates, service providers, suppliers, data aggregators, and third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
328
329**No Sales of Personal Information**
330
331Xerox has not sold Personal Information as defined or as contemplated by the CCPA in the preceding 12 months. As defined and contemplated by the CCPA, Xerox does not sell Personal Information of minors under the age of 16.
332
333**California Consumer Privacy Rights**
334
335As a California Consumer, you have the following rights:
336
337- **Right to Disclosure:** California Consumers have a right to request information from Xerox regarding the Personal Information Xerox collects and discloses for business purposes about the consumer.
338
339- **Deletion:** In certain circumstances, you have the right to request we delete Personal Information we collected from you. Please note that the right to request deletion is subject to certain exceptions under the CCPA.
340
341- **Non-Discrimination:** Xerox will not discriminate against California Consumers for exercising their rights under the CCPA.
342
343Xerox does not offer financial incentives or price or service differences in exchange for the retention of a California Consumer's Personal Information.
344
345**How to Submit a Verifiable Request**
346
347- Xerox will respond to requests in accordance with the CCPA if it can verify the identity of the individual submitting the request. California Consumers can exercise these rights by contacting 1-866-XRX-0001 or by email at [privacy@xerox.com](mailto:privacy@xerox.com). We may not be able to comply with your request if we are unable to confirm your identity or connect the information you submit in your request with Personal Information in our possession.
348
349**Authorized Agent**
350
351A California Consumer may designate an Authorized Agent registered with the California Secretary of State to submit a disclosure or deletion request on behalf of the Consumer. For Xerox to respond to a request from an Authorized Agent, Xerox may:
352
353- Request a copy of the written permission granting the Authorized Agent to make such a request on the consumer's behalf; and
354
355- Verify the identity of the consumer.
356
357Xerox may deny a request from an Authorized Agent that does not submit proof that they have been authorized by a consumer to act on their behalf.