INTRODUCTION
Cotopat is an interactive caption display system that includes hardware and software. It recognizes speech in real-time, converting conversation into text and displaying the text on Cotopat screen in multiple languages. Additionally, Cotopat allows you to upload the supportive visual materials,
such as images, videos, or diagrams, that help the audience better understand and remember the information shared during the conversation.
In this Statement, we will explain in detail the following:
I. For which purposes we are processing your personal data;
II. On what legal basis we are processing your personal data;
III. With whom we share your personal data;
IV. To which countries we transfer your personal data;
V. For how long we keep your personal data;
VI. Which technical and organizational measures we have taken;
VII. What your legal rights are concerning us processing your personal data;
VIII. How you can contact us and other important information;
IX. Changes to this Privacy Statement;
X. Prevailing Language.
I. FOR WHICH PURPOSES ARE WE PROCESSING YOUR PERSONAL DATA?
A. Provision of Cotopat. In order to enable the user to use Cotopat and to manage the conversational logs KYOCERA processes personal data related to the conversations conducted via Cotopat. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
B. Invoicing. To invoice services to customer, KYOCERA processes personal data related to customer name, license type, contract date and status, payment status, device ID, number of devices in the customer’s organisation.
C. User account management. KYOCERA obtains email address either directly from you or indirectly from a KYOCERA customer (probably your employer or organization) so that we can set-up and manage a user account for you. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
D. Provision of Speech-to-Text. To convert conversation to text KYOCERA uses Google Speech-to-text API. Audio data is transmitted from Cotopat to Google’s servers over secure HTTPS connections. Audio data means your voice. These data is encrypted in transit. Google processes the data to perform speech recognition and to generate the transcription. KYOCERA does not process conversational data, unless customer choose the option to record the conversation, as provided in section 1.E. For more information about data usage in Google Speech to Text API read the data usage FAQ.
Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
E. Provision of conversation summary. For the provision of conversation summary to person you interact with via Cotopat, conversation is recorded, audio data and transcription data is processed by KYOCERA to provide a conversation summary. For this purpose KYOCERA uses Google Vertex AI. The transcribed text is transmitted to a generative model Gemini in Vertex AI. The model generates a summary based on the transcription. For more information about Vertex AI read the Google Vertex AI (Gemini) documentation.
Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
F. Translation. To provide you with the translation of both transcription and conversation summary KYOCERA uses Google Translation API. The content of the text is only used by Google as necessary to provide the Cloud Translation API service. For more information about data usage in Google Translation API read the data usage FAQ.
Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
G. Remote maintenance. KYOCERA may access your personal data, which is processed within the local administrator’s account for bug fixing or trouble shooting purposes. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
H. Hosting. KYOCERA uses Google Cloud Platform, Belgium, as a cloud storage provider. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at www.kyoceradocumentsolutions.eu.
II. ON WHAT LEGAL BASIS ARE WE PROCESSING YOUR PERSONAL DATA?
KYOCERA processes personal data for the purposes mentioned above in order to perform its contractual rights and obligations as agreed with its customers, Article 6(1)(b) GDPR. To the extent that you as a data subject are not party to agreement between Kyocera and its customers, Kyocera processes your personal data based on its legitimate interests, Art. 6(1)(f) GDPR, whereas Kyocera’s contractual obligations to perform Cotopat-related services constitute its legitimate interests.
We have made a careful assessment of your fundamental rights and freedoms and our legitimate business interests and are continuously monitoring the balance. Should you however wish to object to the processing of your personal data please see the section ‘Your rights’ below. Since the processing of personal data is necessary for Kyocera to provide Cotopat, please note that your objection to the processing make the use of Cotopat impossible for you. Please note that in cases where Kyocera processes personal data as a data processor on behalf of its customers, the customers qualify as data controllers, and are as such responsible for the processing of your personal data.
III. With whom we share your personal data;
Your personal information shall only be shared with:
+ KYOCERA Document Solutions Inc. (Japan) for the provision of Cotopat application software, for remote support services and to provide access and management of the Cotopat application software.
+ Google Cloud Japan G.K. (Google data center in Belgium), for cloud hosting services and for the provision of Google Translation API, Google Speech-to-Text API and Google Vertex AI model Gemini.
To the extent we are required by law, regulation, or court order to disclose your personal data, we may have to share your personal data in compliance with that law, regulation, or court order.
IV. INTERNATIONAL TRANSFERS
Where we transfer (see above to whom we are sharing your personal data with) your personal data to a service provider which is based in a country that does not provide an adequate level of protection by domestic law according to the European Commission, we have ensured this adequate level of protection by agreeing on additional appropriate safeguards with that group company or third party through the conclusion of Standard Contractual Clauses as adopted by the European Commission and supplementary measures. A list of countries that have ensured an adequate level of protection according to the European Commission can be found here. You may request a copy of the Standard Contractual Clauses by sending us an email, motivating your request.
Alternatively, we may ask you for your explicit consent to the proposed transfer.
V. FOR HOW LONG DO WE KEEP YOUR PERSONAL DATA?
Where possible, we have set specific retention periods for keeping your personal data. These specific retention periods are stated below, or we shall communicate these to you at or before we start processing your personal data.
Where it is not possible for us to use set retention periods, we have stated below the criteria that we use to determine the retention periods.
Specific retention periods
Purpose (A) Provision of Cotopat. If you chose to record the conversation, conversation record will be deleted 30 days after the recording.
Purpose (B) Invoicing. In order to comply with generally accepted accounting principles, we store billing reports for one year or as long as it is required by law.
Purpose (C) User account management. We shall keep your personal information related to your user account as long as you have an active user account with us. Upon your/your organization’s explicit request we delete your user account. In that instance, we shall erase your user account within 5 business days after your request.
Purpose (D) Speech-to-Text. To provide Speech-to-Text API, Google processes audio in memory and does not store any customer data. Google temporarily logs some metadata about your Speech-to-Text API requests (such as the time the request was received and the size of the request) in order to improve their service and combat abuse.
Purpose (E) conversation summary. To provide the person with whom you are interacting via Cotopat a conversation summary KYOCERA stores conversation summary for the period of 30 days.
Purpose (F) Translation. To provide text translation via Google Translation API Google holds text briefly in-memory in order to perform the translation and return the results to you.
Purpose (G) Remote maintenance. For remote maintenance and support services, KYOCERA may have access to personal data. Personal data that is processed for remote maintenance services will be deleted 7 days after completion of the services.
Criteria for determining retention periods
In any other circumstances, we use the following criteria to determine the applicable retention period:
+ The assessment of your fundamental rights and freedoms;
+ The purpose(s) of processing your personal data. We shall not keep your personal data longer than is necessary for the purpose(s) we collected it for.
+ Any relevant industry practices or codes of conduct on keeping personal data;
+ The level of risk and cost associated with keeping your personal data (accurate and up-to-date);
+ Whether we have a valid lawful basis to keep your personal data;
+ The nature, scope and context of processing of your personal data and our relationship with you;
+ Any other relevant circumstances that may apply.
In any case, we shall keep your personal data in compliance with applicable legal requirements and we make periodical reviews of the personal data we hold.
VI. WHICH TECHNICAL AND ORGANIZATIONAL MEASURES WE HAVE TAKEN
We take the security of your personal data very seriously and take all reasonable efforts to protect your personal data from loss, misuse, theft, unauthorized access, disclosure or modification.
For more information regarding IT-Security measures, you may request a copy of the Cotopat Security Whitepaper by sending us an email, motivating your request.
VII. YOUR RIGHTS
You have certain legal rights that we wish to inform you of. The processing of personal data is necessary to achieve the above-mentioned purposes for KYOCERA to comply with its contractual obligations towards its customers. Where KYOCERA processes your personal data as Data Processor, KYOCERA is obliged to liaise with the Data Controller before realizing your request.
Access. You have the right to be informed on whether we process your personal information or not and to related information on that processing.
Rectification. You have the right to have your personal information rectified or completed by us without undue delay. If you have set up an account with us, you have the possibility to rectify or complete your personal information yourself.
Right to be forgotten. You have the right to have your personal information erased by us without undue delay. This right is limited to specific grounds, for example if you have withdrawn your consent, or if you object and there are no overriding legitimate grounds for us to maintain the processing. If you have an account with us, you have the option to erase your personal data yourself, in which case all your personal data is permanently deleted. In order to prevent that the user account will be deactivated, alternative contact details shall be provided.
Restriction of processing. You have the right to request that we restrict the processing of your personal information based on specific grounds. These are (1) the time for us to verify the accuracy of your personal information on your request; (2) instead of erasure of unlawful processing, you request restriction of use instead; (3) you need personal information in legal proceedings; or (4) we are verifying whether our legitimate grounds override your objection to the processing.
Right to object. You have the right to object at any time to our processing of your personal information if such processing is (1) based on our legitimate interest (including us making a profile of you based on your consent); (2) for direct marketing purposes; or (3) necessary for the performance of a task carried out in the public interest or exercise of official authority vested in us. We shall cease to process your personal information based on your objection, unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or if we need your personal information in legal proceedings.
Data portability. We are required to inform you of your right to receive your personal information from us so that you can transmit that personal information to another service provider.
Consent withdrawal. If you have supplied us with your personal information based on your consent, you have the right to withdraw such consent at any time. You may do so by unsubscribing from the service that you have subscribed to if applicable. You may also do so by sending us an email to the applicable privacy email address as stated below. We shall then permanently remove your personal information from our database.
Lodging a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the country of your residence, about our processing of your personal information. You can find a complete list of supervisory authorities here.
VIII. EXERCISING YOUR RIGHTS AND CONTACTING US
At KYOCERA we have a network of privacy professionals available, including Data Protection Officers, to assist you with your queries. If you wish to exercise any of your rights, or you have a question about this document, please contact us via email, or send us a letter to:
KYOCERA Document Solutions Europe Management B.V.
Attn.: Data Protection Officer
Beechavenue 27
1119 RA Schiphol-Rijk
The Netherlands
e: privacy@deu.kyocera.com
Or use our data subjects’ request form available at https://www.kyoceradocumentsolutions.eu/en/footer/data-request.html
IX. CHANGES TO THIS PRIVACY STATEMENT
In the event that we modify this document, we will publish it on our website with a revised publication date and, if applicable, notify you of the changed document via your user account.
X. PREVAILING LANGUAGE
The English version of this Privacy Statement represents the understanding of both Parties. In the event any translation of this Privacy Statement is prepared for convenience or any other purpose, the provisions of English version shall prevail.
