Data Protection Declaration

1. Information regarding the collection of personal data

1.1. Below, we will provide you with information about the collection of personal data in the case of conclusion of an employment contract as a client, professional company, supplier, business partner, or other contractual partner (for example, as part of an application or employment relationship) or when using our website. Personal data pertains to all data traceable to you personally, such as name, address, email addresses, user behaviour.

1.2. The responsible party as per Art. 4 (7) EU General Data Protection Regulation (GDPR) and other national data protection laws in the member states as well as other legal provisions related to data protection is:

Toshiba TEC UK Imaging Systems Ltd.
Abbey Cloisters
Abbey Green
Chertsey
Surrey
KT16 8RB

Tel: 0843 2244944
Email: GDPR@toshibatec.co.uk

1.3. When you contact us via post, telephone, email or contact form, the information you provide (your email address, your name and your telephone number, if applicable) will be stored by us to answer your questions. We delete the data gathered in this context once its storage is no longer necessary or we restrict its processing should statutory retention obligations exist. Furthermore, we collect and use personal data of the data subjects and users of our website only - among others, to provide a functioning website - as far as this is necessary in the context of our contents and services or in the context of a contract fulfilment. The collection and use of personal data from the data subjects and users of our website can generally only take place once consent has been granted by the users. An exception applies in cases where prior consent cannot be given for practical reasons and/or the processing of the data is permitted by legal regulations.

1.4. Should we wish to make use of subcontracted service providers for individual features of our offer, or use your information for promotional purposes, we will subsequently inform you about the respective processes in detail. In doing so we will also indicate the fixed criteria for the storage period.

2. Your rights – Legal grounds

2.1. You have the following rights in relation to us with regards to your personal data:

- Right to access
- Right to rectification or erasure
- Right to restriction of processing
- Right to objection to processing
- Right to data transferability.

2.2. You also have the right to complain about our processing of your personal data to a data protection monitoring body.

2.3. Where we obtain consent from the data subject for processing personal data, Art. 6 (1)(a) GDPR provides the legal grounds for the processing of personal data. When processing personal data required for the performance of a contract in which the data subject is a contracting party, Art. 6 (1)(b) GDPR provides the legal grounds. This also applies to processing procedures required for the implementation of pre-contractual measures. Where the processing of personal data is required for compliance with a legal obligation to which our company is subject, Art. 6 (1)(c) GDPR provides the legal grounds. In the case that the vital interests of the data subject or another natural person render the processing of personal data necessary, Art. 6 (1)(d) GDPR provides the legal grounds. If the processing is required to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the first-named interests, Art. 6 (1)(f) GDPR provides the legal grounds for processing.

3. Collection of personal data when visiting our website

3.1. In the event of purely informational use of the website, i.e., if you don’t register or otherwise provide us with information, we will only collect the personal data that your browser transfers to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to show you our website and to ensure stability and security (legal grounds Art. 6 (1) Clause 1 (f) GDPR):

- IP address
- Date and time of the request
- Time Zone Difference to Coordinated Universal Time (UTC)
- Content of the request (specific page)
- Access status/http status code
- Each transmitted quantity of data
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software.

3.2. In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and assigned to the browser that you are using and allow the site that sets the cookie (here ours) to receive certain information. Cookies cannot run programs or transfer viruses to your computer. They serve to make the internet experience more user-friendly and effective overall.

3.3. Use of cookies:

3.3.1. This website uses the following types of cookies, the scope and operation of which are explained below:

- Transient Cookies (for this 3.3.2.)
- Persistent Cookies (for this 3.3.3.)

3.3.2. Transient cookies are automatically deleted when you close the browser. In particular, these include the session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the common session. This will allow your computer to be recognised when you return to our website. The session cookies are deleted when you log out or close the browser.

3.3.3. Persistent cookies are automatically deleted after a specified period, which may differ depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

3.3.4. You can configure your browser settings according to your wishes and, for example, reject the acceptance of third-party cookies or all cookies. Please be aware that you may not be able to use all features of this website.

3.3.5. All data is deleted as soon as it is no longer required to fulfil the purpose of its collection. If the data is collected for the provision of the website, this is the case when the respective session is completed.

3.3.6. If the data is stored in log files, this is the case after seven days at the latest. Further storage is possible. The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, there is no possibility of objection on the part of the user.

3.3.7. We use the LinkedIn Insight tag which allows us to analyse general statistics on visitors to our websites via our LinkedIn campaigns, allowing us to refine and tailor our content to user interests. The LinkedIn Insight tag creates a LinkedIn browser cookie in a user’s browser enabling collection of the following data: IP address, timestamp and page events (e.g. page views). The IP addresses are either truncated or cached (if they are used to reach members via several devices). Members’ login names are removed within seven days to pseudonymise the data with remaining pseudonymised data deleted within 180 days. LinkedIn does not share any personal data with us, and instead only offers us reports (in which you are not identified) on the website target group and advertising performance. You can find further information at: https://www.linkedin.com/help/linkedin/answer/65521.

4. Other features and offers of our website – external service providers

4.1. In addition to the purely informative use of our website, we offer various services that you may be interested in using. To do this, you will generally need to provide other personal information that we use to provide the service and for which the aforementioned data processing principles apply.

4.2. In some instances, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are audited regularly.

4.3. Where our service providers or partners have their headquarters in a state outside of the European Economic Area (EEA), we will inform you about the circumstances.

5. Objection to or revocation of the processing of your data

5.1. Should you have granted consent for the processing of your data you may modify or completely revoke this at any time without providing reasons. You can send this revocation to us (see Clause 1.2. – Responsible Party) by post, email, fax, or in the form that was used when issuing the declaration of consent. No extra costs are incurred in such cases, other than postage costs or transmission costs in accordance with existing basic tariffs.

Such a revocation will impact the legitimacy of the processing of your personal data once you have sent it to us.

5.2. Where we support the processing of your personal data by referring to the balance of interests you can submit an objection to the processing. This is the case in particular if we do not require the processing to fulfil a contract with you. In the case of the following website uses, this will be additionally shown by us in the following description of the function. When exercising such an objection we ask that you provide the reasons for which we should not have processed your personal data as we have done. In the case that you provide an objection with reasons we will examine the situation and will either adjust or modify the data processing or indicate to you the mandatory reasons for continuing with the processing.

5.3. Of course, you may object to the processing of your personal data for marketing and data analysis purposes at any time. You may inform us about your objections to marketing by contacting us using the following contact information: GDPR@toshibatec.co.uk

6. Use of Google Analytics

6.1. This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, due to the activation of IP anonymisation on this website, your IP address will be shortened by Google beforehand within member states of the European Union or another contracting state of the Agreement on the European Economic Area (EEA). The full IP address will only be sent to a Google server in the US and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website usage and internet usage to the website operator.

6.2. The IP address provided by Google Analytics as part of Google Analytics will not be merged with other Google data.

6.3. You can prevent the storage of cookies with corresponding settings for your browser software; however, we point out that in this case you may not be able to use all features of this website in full. You may also prevent Google's collection of data (including your IP address) generated by the cookie from your use of the website from Google and the processing of such data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

6.4. This website uses Google Analytics with the extension "_anonymizeIp()". As a result, IP addresses are processed in a shortened form; a direct personal reference can be excluded. If a personal reference is contained in the data collected about you, it will be immediately excluded, and the personal data will be deleted immediately.

6.5. We use Google Analytics to analyse and regularly improve the use of our website. We can improve our offering with the statistics and make it more relevant for you as a user. For the exceptional cases in which personal data is transferred to the US, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 (1) Clause 1 (f) GDPR.

6.6. Information about third-party providers: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of service: http://www.google.com/analytics/terms/gb.html, Overview of data protection: http://www.google.com/intl/en/analytics/learn/privacy.html, as well as the privacy policy: http://www.google.de/intl/en/policies/privacy.

7. Social Media

Since we are present on various social media platforms (digital technologies and media) using a business account (page or channel), we wish to inform you about the corresponding uses and data processing there.

When you visit our page or channel, the social media provider as the party responsible uses cookies to collect personal data from its users. Data may also be collected from visitors to the page or channel who are not logged in or registered with that social media provider.

The person responsible for the content of our business accounts is named in this declaration under section 1.2.

We are unable to confirm what user data a particular social media provider collects. Therefore, you use social media sites at your own risk. In addition, Toshiba does not have full access to the data collected or your profile data. We can only see the public information of your profile. You can choose which data you make available publicly by adjusting your social media settings.

The statistics listed below are used to continuously improve our online offer on our social media platforms and to better cater to our users’ interests. We cannot draw any conclusions on individual visitors from statistical data or link statistics to visitor profile data. You can adjust your social media settings to decide how targeted advertising is displayed to you.

If we have a statutory obligation to store your data, the data will be stored for the duration of the statutory retention period. Legal basis for processing data is Article 6(1)(f) of the GDPR.

7.1. YouTube

For information on how data is collected and processed by YouTube, please see the YouTube Privacy Policy at https://policies.google.com/privacy?hl=en-GB&gl=uk.

On the basis of legitimate interests, we receive anonymous statistics from YouTube on how our page is used, which contain the following information:

- Followers: Number of people who follow Toshiba, including growth and development over a defined period of time.
- Reach: Number of people who see a specific post; number of interactions on a post, which tells us what content is better received in the community than others.
- Ad performance: How many people have been reached with a post or paid ad and interacted with it.

Toshiba receives personal data from YouTube if you actively share it with us in a private message on YouTube. We use your data (first name, last name, etc.) to respond to your queries, which are stored for this purpose.

We also receive personal data from YouTube if you submit a form to us with pre-filled fields containing data from your profile; in clicking the button, you actively send the data to us.

We will delete the data from your enquiry/contact three months after the last message.

7.2. LinkedIn

Toshiba uses the technical platform and services of the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland for the information service provided on LinkedIn.

For information on how data is collected and processed by LinkedIn, please see the LinkedIn Privacy Policy at https://www.linkedin.com/legal/privacy-policy.

On the basis of legitimate interests, we receive anonymous statistics from LinkedIn on how our page is used, which contain the following information:

- Followers: Number of people who follow Toshiba, including growth and development over a defined period of time.
- Reach: Number of people who see a specific post; Number of interactions on a post, which tells us what content is better received in the community than others.
- Ad performance: How many people have been reached with a post or paid ad and interacted with it.
- Number of clicks on a customised button (e.g. ‘Visit website’) to determine how a user uses the page.

Toshiba receives personal data from LinkedIn if you actively share it with us in a private message on LinkedIn. Toshiba also receives personal data from LinkedIn if you submit a form to us with pre-filled fields containing data from your profile; by clicking the button, you actively send the data to us. We use your data (first name, last name, etc.) to respond to your queries, which are stored for this purpose.

We will delete the data from your enquiry/contact three months after the last message.

7.3. Facebook

For information on how data is collected and processed by Facebook, please see the Facebook Privacy Policy at https://www.facebook.com/policy.php.

You can adjust your Facebook settings to actively hide your likes or unfollow the page. Your profile will then no longer appear in the list of users of our site.

Toshiba receives anonymous statistics from Facebook on how our page is used, which contain the following information:

- Followers: Number of people who follow Toshiba, including growth and development over a defined period of time.
- Reach: Number of people who see a specific post; number of interactions on a post, which tells us what content is better received in the community than others.
- Ad performance: How many people have seen an ad.
- Demographic: Average age, gender, location, and language of visitors.

Toshiba receives personal data from Facebook if you actively share it with us in a private message on Facebook. We use your data (first name, last name, etc.) to respond to your queries, which are stored for this purpose and deleted three months after the last message.

7.4. Twitter

For information on how data is collected and processed by Twitter, please see the Twitter Privacy Policy at https://twitter.com/en/privacy.

On the basis of legitimate interests, we receive anonymous statistics from Twitter on how our page is used, which contain the following information:

- Followers: Number of people who follow Toshiba, including growth and development over a defined period of time.
- Reach: Number of people who see a specific post; number of interactions on a post, which tells us what content is better received in the community than others.
- Ad performance: How many people have been reached with a post or paid ad and interacted with it.

Toshiba receives personal data from Twitter if you actively share it with us in a private message on Twitter. We use your data (first name, last name, etc.) to respond to your queries, which are stored for this purpose.

We also receive personal data from Twitter if you submit a form to us with pre-filled fields containing data from your profile; in clicking the button, you actively send the data to us.

We will delete the data from your enquiry/contact three months after the last message.

8. Google Maps integration

8.1. We use Google Maps on our website. This allows us to show you interactive maps directly on the website and allows you to conveniently use the map feature.

8.2. By visiting the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data referred to in Clause 3 of this declaration will be transmitted. This is done regardless of whether Google provides an account that you are logged in to, or if there is no user account. If you're logged in via Google, your data will be assigned directly to your account. If you do not wish this to be associated with your profile on Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for purposes of advertising, market research and/or tailor-made website design. Such an evaluation is done in particular (even for non-logged in users) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the formation of these user profiles, whereby you must contact Google to exercise them.

8.3. For more information on the purpose and scope of the data collection and its processing by the plug-in provider, please refer to the provider's privacy policy. There, you will also find more information about your rights and settings options to protect your privacy: https://www.google.de/intl/en/policies/privacy. Google also processes personal information in the US and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework

9. Integration of YouTube videos

9.1. We've included YouTube videos in our online offering, which are stored on http://www.youtube.com and are directly accessible from our website. User data is transferred when the videos are played. We have no influence on this data transfer.

9.2. By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data referred to in Clause 3 of this declaration will be transmitted. This is done regardless of whether YouTube provides an account that you are logged in to, or if there is no user account. If you're logged in via Google, your data will be assigned directly to your account. If you do not wish to be associated with your profile on YouTube, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for purposes of advertising, market research and/or tailor-made website design. Such an evaluation is done in particular (even for non-logged in users) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the formation of these user profiles, whereby they must be directed to YouTube for the exercise.

9.3. Please read the privacy policy for more information on the purpose and scope of your data collection and processing through YouTube. There you will also get further information about your rights and settings options to protect your privacy: https://www.google.de/intl/en/policies/privacy. Google also processes personal information in the US and is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

10. Contact form and email contact

10.1. There is a contact form on our web page which can be used to get in touch electronically. If you make use of this option, the data you provide will be transferred to and saved by us. This data includes:

Required fields:
- Name
- Email address

Optional:
- Company name
- Phone number
- Enquiry

At the time of sending the message the following data is also saved:

a) IP address
b) Date and time of sending the request

For the processing of the data, your consent will be obtained within the scope of the sending process and you will be referred to the data protection declaration. Alternatively, you can get in touch via the email address provided. In this case, the user's personal data transmitted with the email will be saved. In this connection, there is no forwarding of the data to third parties. The data is solely used for processing the conversation.

10.2. The legal grounds for data processing, in the case that consent is granted by the user, are provided by Art. 6 (1)(a) GDPR. The legal grounds for data processing, transferred as part of an email, are provided by Art. 6 (1)(f) GDPR. If the purpose of the email/mail contact is the performance of a contract, Art. 6 (1)(b) GDPR provides additional legal grounds for processing.

10.3. The processing of personal data from the input screen solely serves us for contact purposes. In the case of contact being established by email, the required justified interests in the processing of the data are also included. Other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our IT systems.

10.4. The data is deleted as soon as it is no longer required to fulfil the purpose of its collection. This is the case for the personal data from the contact form input screen and that transferred by email if the respective conversation with the user has been brought to a close. The conversation has been brought to a close if circumstances indicate that the relevant subject matter has been conclusively clarified.

10.5. The user has the option at all times to revoke their consent to the processing of their personal data. Should the user contact us via email, they can modify or completely revoke the storage of their personal data with immediate effect for the future at any time without providing any reasons. In such a case, the conversation cannot be continued. This revocation can be sent to us by post, email (for address details etc. see Clause 1.2.), or in the form that was used when issuing the declaration of consent. Personal data stored during the establishment of contact is deleted in this case.

11. Toshiba Service Portal

11.1. Our website includes a service portal which we make available to our service support customers. If you use the portal we will collect and use the following information, which is in addition to the information our website normally collects:

- Name
- Job title
- Location address
- Phone number
- Email address
- Your portal login credentials
- Support tickets you log using the portal
- Respective device details and usage statistics
- Any messages you exchange with our staff through the portal
- Any comments you post in relation to published articles or otherwise

11.2. If you are using the portal it will usually be because you or an organisation you work for has purchased support services from us which we provide via the portal. We use the data collected by the portal to administer your access to the portal, to respond to support tickets which you or others in your organisation log via the portal, to enable you to use the portal to monitor progress on those support tickets, and to provide the support services.

11.3. Our legal basis for using your data is that it is necessary for our legitimate interests in making the portal available to you and providing the support services that you or your organisation have purchased. We believe that this interest is not outweighed by your interests. However, if you object to us using the data in this way you have a right to object, as explained in paragraph 5.3 above. If you object to us using the data or if you decide not to provide your data we may not be able to provide you with access to the portal service.

11.4. We share the data gathered through the portal with ServiceNow UK Limited who are registered in England and Wales under company number 06299383. We do so under contracts which require them to use the data only for the purposes outlined above.

11.5. The data we gather through the portal is deleted once it is no longer required for the purposes outlined above.