Kyocera Cloud Print and Scan: Privacy Statement

KYOCERA Document Solutions Europe B.V. (“KYOCERA”, “we” or “us”), located at Beechavenue 27, 1119 RA Schiphol-Rijk, The Netherlands, issued this Privacy Statement (“Statement”) to inform you, the user of KYOCERA Cloud Print and Scan, about the processing of your personal data when your organization creates a user account for you and when you download and use Kyocera Cloud Print and Scan on your terminal device.

INTRODUCTION

Kyocera Cloud Print and Scan is a web-based office solution that allows office admins to easily set up and manage user accounts, register HyPAS MFPs, and track print and scan activities for their own organizations. Additionally, Kyocera Cloud Print and Scan allows end users to print and scan from their terminal device as well as link their cloud storage account with their Kyocera Cloud Print and Scan account and print or scan jobs on their printer registered within their organization.

In this Statement, we will explain in detail the following:

I. FOR WHICH PURPOSES ARE WE PROCESSING YOUR PERSONAL DATA?

• Printing and scanning. In order to complete print and scan jobs, KYOCERA processes meta data (device IP addresses, serial number, hostname, date of job creation, print/scan job name, job execution, number of pages, filename, size, Print/Scan ID Card number and registration date). Kyocera Cloud Print and Scan stores the content of the printed/scanned documents for a maximum period of 8 days.
• Invoicing. KYOCERA processes the license type, Tenant ID, date, time, number of devices to invoice these services to customers.
  
• User account management. KYOCERA obtains names and email addresses either directly from you or indirectly from a KYOCERA customer (probably your employer or organization) so that we can set-up and manage a user account for you. Note that we2provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
  
• Remote maintenance. A KYOCERA service engineer may access your personal data, which is processed within the local administrator’s account for bug fixing or trouble shooting purposes. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
  
• Hosting. KYOCERA uses Amazon Web Services, Germany, as a cloud storage provider. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.

II. ON WHAT LEGAL BASIS ARE WE PROCESSING YOUR PERSONAL DATA?

KYOCERA processes personal data for the purposes mentioned above in order to perform its contractual rights and obligations as agreed with its customers, Article 6(1)(b) GDPR. To the extent that you as a data subject are not party to agreement between Kyocera and its customers, Kyocera processes your personal data based on its legitimate interests, Art. 6(1)(f) GDPR, whereas Kyocera’s contractual obligations to perform Kyocera Cloud Print and Scan-related services constitute its legitimate interests.

We have made a careful assessment of your fundamental rights and freedoms and our legitimate business interests and are continuously monitoring the balance. Should you however wish to object to the processing of your personal data please see the section ‘Your rights’ below. Since the processing of personal data is necessary for Kyocera to provide Kyocera Cloud Print and Scan, please note that your objection to the processing make the use of Kyocera Cloud Print and Scan impossible for you. Please note that in cases where Kyocera processes personal data as a data processor on behalf of its customers, the customers qualify as data controllers, and are as such responsible for the processing of your personal data.

III. WHO ARE WE SHARING YOUR PERSONAL DATA WITH?

Your personal information shall only be shared with:

• KYOCERA Document Solutions Development America, Inc. (CA, USA) for remote maintenance services;
• KYOCERA Document Solutions, Inc., Japan for remote maintenance services;
  
• KYOCERA Document Solutions Europe B.V., Branch Office Germany, for remote maintenance services
  
• Amazon Web Services, Germany, for the provision of cloud services;
  
• To the extent we are required by law, regulation or court order to disclose your personal data, we may have to share your personal data in compliance with that law, regulation, or court order.

IV. INTERNATIONAL TRANSFERS

Where we transfer (see above to whom we are sharing your personal data with) your personal data to a service provider which is based in a country that does not provide an adequate level of protection by domestic law according to the European Commission, we have ensured this adequate level of protection by agreeing on additional appropriate safeguards with that group company or third party through the conclusion of Standard Contractual Clauses as adopted by the European Commission and supplementary measures. A list of countries that have ensured an adequate level of protection according to the European Commission can be found here. You may request a copy of the Standard Contractual Clauses by sending us an email, motivating your request.

Alternatively, we may ask you for your explicit consent to the proposed transfer.

V. FOR HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Where possible, we have set specific retention periods for keeping your personal data. These specific retention periods are stated below, or we shall communicate these to you at or before we start processing your personal data.

Where it is not possible for us to use set retention periods, we have stated below the criteria that we use to determine the retention periods.

Specific retention periods

• Purpose (A) Printing and scanning. Unless customized by the Kyocera Cloud Print and Scan Customer, expired print and scan jobs are automatically deleted after 8 days.
• Purpose (B) Invoicing. In order to comply with generally accepted accounting principles, we store billing reports for one year.
  
• Purpose (C) User account management. We shall keep your personal information related to your user account as long as you have an active user account with us. There is no obligation for you from our side to have your account set-up. If you don’t log in for the first time within 7 days of creation of the account, we shall erase it. Upon your/your organization’s explicit request we delete your user account. In that instance, we shall erase your user account within 30 days after your request. Your personal data may be stored after the deletion of your account in our back-up systems, and will automatically be deleted after 35 days. Inactive user accounts are automatically deleted one year after last use.
  
• Purpose (D) Remote maintenance. For remote maintenance and support services, KYOCERA may have access to personal data. Personal data that is processed for remote maintenance services will be deleted 7 days after completion of the services.
  

• The assessment of your fundamental rights and freedoms;
• The purpose(s) of processing your personal data. We shall not keep your personal data longer than is necessary for the purpose(s) we collected it for.
  
• Any relevant industry practices or codes of conduct on keeping personal data;
  
• The level of risk and cost associated with keeping your personal data (accurate and up-to-date);
  
• Whether we have a valid lawful basis to keep your personal data;
  
• The nature, scope and context of processing of your personal data and our relationship with you;
  
• Any other relevant circumstances that may apply.
  

VI. WHICH TECHNICAL AND ORGANIZATIONAL MEASURES WE HAVE TAKEN

We take the security of your personal data very seriously and take all reasonable efforts to protect your personal data from loss, misuse, theft, unauthorized access, disclosure or modification.

VII. YOUR RIGHTS

You have certain legal rights that we wish to inform you of. The processing of personal data is necessary to achieve the above-mentioned purposes for KYOCERA to comply with its contractual obligations towards its customers. Where KYOCERA processes your personal data as Data Processor, KYOCERA is obliged to liaise with the Data Controller before realizing your request.

• Access. You have the right to be informed on whether we process your personal information or not and to related information on that processing.
• Rectification. You have the right to have your personal information rectified or completed by us without undue delay. If you have set up an account with us, you have the possibility to rectify or complete your personal information yourself.
  
• Right to be forgotten. You have the right to have your personal information erased by us without undue delay. This right is limited to specific grounds, for example if you have withdrawn your consent, or if you object and there are no overriding legitimate grounds for us to maintain the processing. If you have an account with us, you have the option to erase your personal data yourself, in which case all your personal data is permanently deleted. In order to prevent that the user account will be deactivated, alternative contact details shall be provided.
  
• Restriction of processing. You have the right to request that we restrict the processing of your personal information based on specific grounds. These are (1) the time for us to verify the accuracy of your personal information on your request; (2) instead of erasure of unlawful processing, you request restriction of use instead; (3) you need personal information in legal5proceedings; or (4) we are verifying whether our legitimate grounds override your objection to the processing.
  
• Right to object. You have the right to object at any time to our processing of your personal information if such processing is (1) based on our legitimate interest (including us making a profile of you based on your consent); (2) for direct marketing purposes; or (3) necessary for the performance of a task carried out in the public interest or exercise of official authority vested in us. We shall cease to process your personal information based on your objection, unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or if we need your personal information in legal proceedings.
  
• Data portability. We are required to inform you of your right to receive your personal information from us so that you can transmit that personal information to another service provider.
  
• Consent withdrawal. If you have supplied us with your personal information based on your consent, you have the right to withdraw such consent at any time. You may do so by unsubscribing from the service that you have subscribed to if applicable. You may also do so by sending us an email to the applicable privacy email address as stated below. We shall then permanently remove your personal information from our database.
  
• Lodging a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the country of your residence, about our processing of your personal information. You can find a complete list of supervisory authorities here.
  

VIII. EXERCISING YOUR RIGHTS AND CONTACTING US

At KYOCERA we have a network of privacy professionals available, including Data Protection Officers, to assist you with your queries. If you wish to exercise any of your rights, or you have a question about this document, please contact us via email, or send us a letter to:

• KYOCERA Document Solutions Europe B.V.
• Attn.: Data Protection Officer
  
• Beechavenue 27, 1119 RA Schiphol-Rijk, The Netherlands
  
• email: privacy@deu.kyocera.com
  

IX. CHANGES TO THIS DOCUMENT

In the event that we modify this document, we will publish it on our website with a revised publication date and, if applicable, notify you of the changed document via your user account.