KYOCERA Fleet Services Privacy Statement

This Privacy Statement (“Statement”) applies to the KYOCERA Document Solutions company (“KYOCERA”, “we” or “us”) located in the country where your company is using KYOCERA Fleet Services (“KFS”). If KYOCERA is not located in the country where your company is using KFS, then this Statement applies to KYOCERA Document Solutions Europe Management B.V., with its corporate seat in Beechavenue 27, 1119 RA Schiphol-Rijk, the Netherlands. A list of the applicable KYOCERA companies is located under the heading ‘Exercising your rights and contacting us’.

This Statement applies to the processing of personal data by KYOCERA in relation to KFS.

You can download this statement in pdf format below:

Introduction

KFS is a powerful, web-based service to perform device management and remote maintenance on a company’s print fleet. KFS enables companies and their service staff to view the device status quickly and easily identify and respond to issues and undertake key maintenance tasks all from any location.

In this Statement, we will explain in detail the following:

• For which purposes we are processing your personal data;
  
• On what legal basis we are processing your personal data;
  
• With whom we share your personal data;
  
• To which countries we transfer your personal data;
  
• For how long we keep your personal data;
  
• Which technical and organizational measures we have taken;
  
• What your legal rights are concerning us processing your personal data;
  
• How you can contact us and other important information. 

For which purposes are we processing your personal data?
 

In order to provide KFS services as agreed, KYOCERA processes your personal data to the purposes listed below. KYOCERA does not process your personal data for marketing purposes.

A. Billing and supply management. KYOCERA processes contact information (e.g. name, email address) to organize the supply of products and services as agreed (e.g. the delivery of toner) and to invoice these services.
 

B. User account management. KYOCERA has obtained your name and email address either directly from you or indirectly from a KYOCERA customer (probably your employer) so that we can set-up and manage a user account for you. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at https://www.kyoceradocumentsolutions.eu/en/products/software/kyocera-fleet-services.html
 

C. Device management. Configuration and maintenance of the device, security settings, asset management, general administrative tasks (such as adding and removing devices). Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at https://www.kyoceradocumentsolutions.eu/en/products/software/kyocera-fleet-services.html
 

D. Remote access. In individual cases and after the user’s specific acceptance, log files with device and personal data are created and sent to the KFS server and used for the purpose of remote maintenance of that particular device. In case a KYOCERA service engineer may have access to the device address book during a remote maintenance session, no information shall be stored from the address book. Note that we provide this service as a data processor according to our Data Processing Terms and Conditions, available at https://www.kyoceradocumentsolutions.eu/en/products/software/kyocera-fleet-services.html
 

E. Quality improvement. Device data, including IP-address and serial number of the device, are used for improving the quality and reliability of the device and consumables as well as system and network scalability. KYOCERA anonymizes personal data before conducting the data analysis.

On what legal basis are we processing your personal data?
 

KYOCERA only processes personal data in accordance with the principles provided by the Regulation (EU) 2016/679 General Data Protection Regulation.

Regarding purpose (A) KYOCERA has a legitimate interest according to Article 6(1)(f) GDPR to have a specific contact person so that KYOCERA can deliver the agreed services to its customers – most likely your employer.

For purposes (B) – (D) we are acting as a data processor and KYOCERA’s customer – as data controller – is responsible to demonstrate the legal basis for these processing purposes.

Regarding purpose (E), the data processing is within KYOCERA’s legitimate interests according to Article 6(1)(f) GDPR for KYOCERA to assess and improve the reliability, quality and performance of the system and customers’ devices.

We have made a careful assessment of your fundamental rights and freedoms and our legitimate business interests and are continuously monitoring the balance. Should you however wish to object to the processing of your personal data please see the section ‘Your rights’ below.

Who are we sharing your personal information with?
 

In order to provide KFS services as agreed, KYOCERA uses third party service providers which may access your personal data. Below you find a list of 3rd parties with which and for what purposes KYOCERA shares your personal data. Your personal information shall only be shared with:

• KYOCERA Document Solutions Europe Management B.V. (Netherlands) for the purpose of user account management and quality improvement;
  
• KYOCERA Document Solutions Inc. (Japan) for the purpose of quality improvement and managing the hosting of the KFS platform and data;
  
• The external KFS hosting provider in the Netherlands (Microsoft Azure region West-Europe);
  
• External service providers for the provision of agreed KFS services and the purpose of quality improvement of KYOCERA products and services. A list of appointed service providers is available at https://www.kyoceradocumentsolutions.eu/en/products/software/kyocera-fleet-services.html;
  
• To the extent we are required by law, regulation or court order to disclose your personal data, we may have to share your personal data in compliance with that law, regulation, or court order.
  

International Transfers

Where we transfer (see above to whom we are sharing your personal data with) your personal data to a service provider which is based in a country that does not provide an adequate level of protection by domestic law according to the European Commission, we have ensured this adequate level of protection by agreeing on additional appropriate safeguards with that group company or third party through the conclusion of Standard Contractual Clauses as adopted by the European Commission. A list of countries that have ensured an adequate level of protection according to the European Commission can be found here. You may request a copy of the Standard Contractual Clauses by sending us an email.

Alternatively, we may ask you for your explicit consent to the proposed transfer.

For how long do we keep your personal data?

Where possible, we have set specific retention periods for keeping your personal data. These specific retention periods are stated below, or we shall communicate these to you at or before we start processing your personal data.

Where it is not possible for us to use set retention periods, we have stated below the criteria that we use to determine the retention periods.

Specific retention periods

Purpose (A) Billing and supply management. Any (personal) information related to this purpose, e.g. invoices, shall be kept for a period of 6 years (business information) or 10 years (accounting information).

Purpose (B) User account management. We shall keep your personal information related to your user account as long as you have an active user account with us. Inactive user accounts shall be erased after one year of last use. There is no obligation for you from our side to have your account set-up; if you don’t log in for the first time within 30 days of creation of the account, we shall erase it. You may always request us to delete your user account. In that instance, we shall erase your user account within 30 days after your request. Your personal data may be stored after the deletion of your account in our back-up systems and will automatically be deleted after 35 days.

Purpose (C and D) Device management and remote access. We will delete KFS logs and the usage history including audit and email logs after 70 days of their creation.

Purpose (E) Quality improvement. Device data, including IP-addresses and serial number, are deleted once the device is removed from KFS.

Criteria for determining retention periods

In any other circumstances, we use the following criteria to determine the applicable retention period:

• The assessment of your fundamental rights and freedoms;
  
• The purpose(s) of processing your personal data. We shall not keep your personal data longer than is necessary for the purpose(s) we collected it for.
  
• Any relevant industry practices or codes of conduct on keeping personal data;
  
• The level of risk and cost associated with keeping your personal data (accurate and up-to-date);
  
• Whether we have a valid lawful basis to keep your personal data;
  
• The nature, scope and context of processing of your personal data and our relationship with you;
  
• Any other relevant circumstances that may apply.
  

In any case, we shall keep your personal data in compliance with applicable legal requirements and we make periodical reviews of the personal data we hold.

Which technical and organizational measures have we taken?

We take the security of your personal data very seriously and take all reasonable efforts to protect your personal data from loss, misuse, theft, unauthorized access, disclosure or modification.

In our continuous efforts to achieve excellence in security, all KYOCERA Document Solutions companies that are named in this Statement have acquired the ISO/IEC 27001 certification for Information Security Management System. In addition, specifically for the KFS service KYOCERA Document Solutions Inc. has acquired the ISO/IEC 27017 certification, which certification ensures additional information security controls applicable to the provision of KFS. For further information we refer you to the KFS Security Whitepaper available at https://www.kyoceradocumentsolutions.eu/en.html

Your rights

You have certain legal rights that we wish to inform you of. The processing of personal data is necessary to achieve the above mentioned purposes for KYOCERA to comply with its contractual obligations towards its customers. In the event you should demand from KYOCERA to delete your personal data, substitute contact details should be provided so that KYOCERA can provide KFS as agreed. As a Data Processor, KYOCERA is obliged to liaise with the Data Controller before realizing your request.

Access. You have the right to be informed on whether we process your personal information or not and to related information on that processing.

Rectification. You have the right to have your personal information rectified or completed by us without undue delay. If you have set up an account with us, you have the possibility to rectify or complete your personal information yourself.

Right to be forgotten. You have the right to have your personal information erased by us without undue delay. This right is limited to specific grounds, for example if you have withdrawn your consent, or if you object and there are no overriding legitimate grounds for us to maintain the processing. If you have an account with us, you have the option to erase your personal data yourself, in which case all your personal data is permanently deleted. In order to prevent that the user account will be deactivated, alternative contact details shall be provided.

Restriction of processing. You have the right to request that we restrict the processing of your personal information based on specific grounds. These are (1) the time for us to verify the accuracy of your personal information on your request; (2) instead of erasure of unlawful processing, you request restriction of use instead; (3) you need personal information in legal proceedings; or (4) we are verifying whether our legitimate grounds override your objection to the processing.

Right to object. You have the right to object at any time to our processing of your personal information if such processing is (1) based on our legitimate interest (including us making a profile of you based on your consent); (2) for direct marketing purposes; or (3) necessary for the performance of a task carried out in the public interest or exercise of official authority vested in us. We shall cease to process your personal information based on your objection, unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or if we need your personal information in legal proceedings.

Data portability. We are required to inform you of your right to receive your personal information from us so that you can transmit that personal information to another service provider. For KFS that means that at your request we shall supply you with your personal information related to your user account. It does not include any device data, including data that was transmitted to us in a log file.

Consent withdrawal. If you have supplied us with your personal information based on your consent, you have the right to withdraw such consent at any time. You may do so by unsubscribing from the service that you have subscribed to if applicable. You may also do so by sending us an email to the applicable privacy email address as stated below. We shall then permanently remove your personal information from our database.

Lodging a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the country of your residence, about our processing of your personal information. You can find a complete list of supervisory authorities here.

Exercising your rights and contacting us
 

At KYOCERA Document Solutions we have a network of privacy professionals available, including Data Protection Officers, to assist you with your queries. If you wish to exercise any of your rights, or you have a question about this document, please contact us via email, or send us a letter to the applicable KYOCERA Document Solutions company in the list below. If your country is not listed, please contact our group Data Protection Officer:

Kyocera Document Solutions Europe Management B.V.

Attn.: Data Protection Office

Beechavenue 27

1119 RA Schiphol-Rijk

The Netherlands

e: privacy@deu.kyocera.com

België/Belgique/Belgien
Kyocera Document Solutions Belgium N.V.
Attn.: Data Protection Officer
Sint-Martinusweg 199-201
1930 Zaventem
e: privacy@dbe.kyocera.com

Danmark
Kyocera Document Solutions Danmark A/S
Attn.: Data Protection Officer
Eljby Industrivej 60
2600 Glostrup
e: privacy@ddk.kyocera.com

Finland
KYOCERA Document Solutions Finland Oy
Attn.: Data Protection Officer
Atomitie 5
00370 Helsinki
e: privacy@dfi.kyocera.com

France
Kyocera Document Solutions France S.A.S.
Attn.: Data Protection Officer
Parc Technologique Route de l’Orme
91195 Saint Aubin
e: privacy@dfr.kyocera.com

Deutschland
Kyocera Document Solutions Deutschland GmbH
Attn.: Data Protection Officer
Otto Hahnstrasse 12
40670 Meerbusch
e: datenschutz@dde.kyocera.com

Deutschland
AKI GmbH
Attn.: Data Protection Officer
Berliner Pl. 9
97080 Würzburg
e: datenschutz@dde.kyocera.com

Österreich
Kyocera Document Solutions Austria GmbH
Attn.: Data Protection Officer
Wienerbergstrasse 11
Turm A, 18. OG, 1100, Vienna
e: privacy@dat.kyocera.com

Italia
Kyocera Document Solutions Italy S.P.A.
Attn.: Data Protection Officer
Via Monfalcone 15
20132 Milan
e: privacy@dit.kyocera.com

Nederland
Kyocera Document Solutions Nederland B.V.
Attn.: Data Protection Officer
Beechavenue 25
1119 RA Schiphol-Rijk
e: privacy@dnl.kyocera.com

Portugal
Kyocera Document Solutions Portugal Lda.
Attn.: Data Protection Officer
Ruaa do Centro Cultural 41
1700-106 Lisbon
e: privacy@dpt.kyocera.com

Rossiya
Kyocera Document Solutions Russia L.L.C.
Attn.: Data Protection Officer
Shchepkina Street, Building 51/4, Block 2
129110 Moscow
e: privacy@deu.kyocera.com

South Africa
KYOCERA Document Solutions South Africa Holdings (Pty) Ltd.
Attn.: Data Protection Officer
Hertford Office Park, 90 Bekker Road CNR Allandale, Vorna Valley, 1682
e: privacy@deu.kyocera.com

South Africa
Kyocera Document Solutions South Africa Pty. Ltd.
Attn.: Data Protection Officer
Hertford Office Park, 90 Bekker Road CNR Allandale, Vorna Valley, 1682
e: privacy@deu.kyocera.com

España
Kyocera Document Solutions España SA
Attn.: Data Protection Officer
Avenida Manacor 2, Parque Rozas, 28290 Las Rozas, Madrid
e: privacy@des.kyocera.com

Sverige
Kyocera Document Solutions Nordic AB
Attn.: Data Protection Officer
Esbogatan 16B
164 75 Kista
e: privacy@dnr.kyocera.com

Switzerland
KYOCERA Document Solutions Europe Management B.V. - Swiss Branch Office
Attn.: Data Protection Officer
Hohlstrasse 614
8048 CH Zürich
e: privacy@deu.kyocera.com

United Kingdom
Kyocera Document Solutions (U.K.) Limited
Attn.: Data Protection Officer
Eldon Court 75-77 London Road, Berkshire
RG1 5BS Reading
e: privacy@duk.kyocera.com

United Kingdom
Midshire Communications Limited
Attn.: Data Protection Officer
Eldon Court 75-77 London Road, Berkshire
RG1 5BS Reading
e: privacy@duk.kyocera.com

Turkiye
Kyocera Bilgitaş Turkey Doküman Çözümleri A.Ş
Attn.: Data Protection Officer
Altunizade Mah. Prof. Fahrettin Kerim Gökay Cad.
No:45 34662 ÜSKÜDAR İSTANBUL
e: privacy@deu.kyocera.com

United Kingdom
Annodata Ltd.
Attn.: Data Protection Officer
The Maylands Building, Maylands Avenue
Hemel Hempstead Industrial Estate, Hemel Hempstead, Hertfordshire HP2 7TG
e: privacy@duk.kyocera.com

Germany
ALOS Handels GmbH
Attn.: Data Protection Officer
Dieselstraße 17
50859 Köln
e: datenschutz@dde.kyocera.com

Switzerland
ALOS Solution AG
Attn.: Data Protection Officer
Bachstrasse 29
8912 Obfelden
e: datenschutz@dde.kyocera.com

Ceska Republica
Kyocera Document Solutions Czech, s.r.o.
Attn.: Data Protection Officer
Harfa Office Park Českomoravská 2420/15
Praha 9, 190 00
e: privacy@deu.kyocera.com

Slovakia 
Kyocera Document Solutions Czech – Slovak Branch Office
Attn.: Data Protection Officer
Rybnicna 40
Bratislava 831 06
e: privacy@deu.kyocera.com

Dubai - UAE
Kyocera Document Solutions Middle East
Attn.: Data Protection Officer
Office 157
Building 17 behind Gloria Hotel, P.O. Box 500817
e: privacy@deu.kyocera.com

Please note that in exercising your rights, we may ask you to complete a request form. We shall then inform you of the process of handling your request.

Changes to this document

In the event that we modify this document, we will publish it on our website with a revised publication date and, if applicable, notify you of the changed document via your user account.