Privacy Notice
Overview:
1. Data protection at a glance
General
The following is a simple overview of what happens to your personal data (personal data is any data that identifies you personally) when you visit the website and depends on which features you use on the website.
Detailed information about data protection is provided below.
Who is responsible for the data collection on this website?
Data processing on this website is carried out by the website operator. You can find the contact details of the website operator in the section "Note on the responsible entity" in this privacy notice.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may, for example, be data that you send to us via the email function. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter the website.
Your data may therefore be collected when:
What data is collected?
The personal data collected from you depends on the use of our services and the use of certain functions available on the website, and the automatic data collection mentioned above.
This can be the following data (list not exhaustive):
Caution: As stated above, if online print and scan jobs are initiated, theoretically, all kinds of personal data can be on the documents and thus be processed via the cloud! We have no influence on which documents are printed or scanned. Therefore, we have no influence on and accept no responsibility for the content of the documents or the personal data contained therein.
What do we use your data for?
Part of the data is collected to ensure the error-free provision of the website.
Moreover, we process the data for the following processing activities:
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the source, recipient, and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time in the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and other questions on the subject of data protection.
2. Hosting
We use multiple hosting services in the delivery of uniFLOW Online.
Generally, data is only processed within the geographical location the uniFLOW Online tenant has been created. Dedicated Microsoft Azure deployments geographical locations can be found here: Reliability - uniFLOW Online. Alternate mail servers are hosted in Hetzner and OVH Cloud to provide resilience and support the Azure hosted mail infrastructure. NT-ware.com globally provides web and resource download infrastructure distributed across Hetzner and OVH.
When you visit uniFLOW Online, your personal data is processed on the aforementioned hosting services. Personal data of European website visitors are generally not hosted on servers located outside the European Union or the European Economic Area but remain within the European Union or the European Economic Area.
For more information on data processing by Microsoft, please refer to the following privacy statement: https://privacy.microsoft.com/en-us/privacystatement.
For more information on data processing by Hetzner, please refer to the following privacy statement: https://www.hetzner.com/legal/privacy-policy.
For more information on data processing by OVH, please refer to the following privacy statement: https://us.ovhcloud.com/legal/eu-privacy-notice.
The use of the above hosting providers is based on Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures.
In all other cases, the processing is based on our legitimate interest, according to Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. Insofar as corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
Order Processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
3. General notes and mandatory information
3.1 General Information about Data Privacy
We, as the provider of the website, take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy notice.
When you use our website, various personal data is collected. This privacy notice explains what information we collect and how we use it. It also explains how and for what purpose this is done.
We would like to point out that data transmission on the Internet (e.g., when communicating by email) can have security gaps. A gapless protection of data against access by third parties is not possible.
3.2 Note on the responsible entity
The responsible entity for this website is:
NT-ware Systemprogrammierungs-GmbH
Niedersachsenstraße 6
49186 Bad Iburg
Germany
Telephone: +49-54 03 - 7243 - 0
Email: privacy@nt-ware.com
3.3 Note on the data protection officer
If you have any questions about your personal data processed by us or this privacy notice, you can contact our data protection officer by email at privacy@nt-ware.com or by post at the address of the responsible entity (see " Note on the responsible entity") with the addition of DATA PROTECTION DEPARTMENT.
3.4 Storage duration
Unless a more specific storage period has been specified within this privacy notice, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be deleted after these reasons no longer apply.
Thus, we treat your personal data with regard to deletion and retention periods as follows:
3.5 Note on data transfer to the USA and other third countries
Among other things, we use tools and services from companies based in the USA or other third countries that are not secure under data protection law. If these tools are active or the data is passed on to the respective service providers, your personal data may be transferred to these third countries and processed there. We would like to point out that no level of data protection comparable to that in the EU can be guaranteed in these countries. For example, US companies are obliged to hand over personal data to security authorities without you, as a data subject being able to take legal action against this. It can, therefore, not be ruled out that US authorities (e.g., intelligence services) process, evaluate, and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities.
3.6 Rights of data subjects and Security
Revocation of your consent to data processing
If data processing is carried out on the basis of your consent, we hereby draw your attention to the fact that you can revoke the consent you have given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right to object to the collection of data in specific cases and to direct marketing
If the data processing is based on Art. 6 para 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy notice. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate interests/reasons for the processing which override your interests, rights, and freedoms or the processing serves the purpose of asserting, exercising, or defending legal claims (objection under Article 21 para. 1 GDPR).
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising (objection pursuant to Art. 21 para. 2 GDPR).
Right of complaint to the competent supervisory authority
In the event of breaches of the GDPR, data subjects shall have a right of complaint to a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged breach. The right of appeal is without prejudice to any other administrative or judicial remedy.
Right of data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
Security
The security of your personal information is very important to us. We use physical, electronic, and administrative security measures to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction.
We also conduct employee training, regular reviews, assessments, and implementation of new (or applicable) technologies, as well as data deletion, encryption, firewalls, and access restrictions.
Furthermore, all personal data is located in data centers with security features that comply with legal requirements. All data is protected in accordance with applicable security standards.
However, due to the nature of the Internet, NT-ware cannot guarantee the security of personal data. In the event that your personal information is or is reasonably suspected to be in the hands of an unauthorized person and applicable law requires notification, we will notify you by email, fax, post, or other appropriate means. NT-ware will promptly notify you to the extent necessary for law enforcement and/or NT-ware to determine the extent of the breach and to investigate and restore the integrity of the data system.
TLS encryption
For security reasons and to protect the transmission of confidential content uniFLOW Online Services use at minimum TLS 1.2 encryption.
Information, deletion, and correction
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its source and recipients, and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time for this purpose and for further questions on the subject of personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. To do this, you can contact us at any time. The right to restriction of processing exists in the following cases:
If you have restricted the processing of your personal data, such data may - apart from being stored - only be processed with your consent or for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.
4. Data collection (detailed)
4.1 Customer Data Storage
Creation of the user account for uniFLOW Online Express
To create your user account for uniFLOW Online Express, it is necessary to process your personal data. The user account is necessary so that you can use uniFLOW Online Express in accordance with the contract. When you submit the completed form, the following data entered will be transferred to us for further processing, and you will receive your access data from us by email. The following data will be processed by us as described above:
The processing of this data is based on Art. 6 para. 1 lit. b GDPR, namely for the fulfillment of the contract for the agreed use of uniFLOW Online Express or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
The data you send to us will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after you have canceled your account or are no longer authorized to use this account). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.
User information:
You have the option to add information about your tenant settings. Some information is mandatory (e.g., email address and postal address), some is optional (e.g., telephone number), and some is automatically assigned to you (e.g., serial number).
The processing of this data is based on Art. 6 para 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in proper user management and making the website user-friendly (Art. 6 para 1 lit. f GDPR) or on your consent (Art. 6 para 1 lit. a GDPR) if this has been requested.
The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after we have completed processing your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.
Online Printing and Scanning
As stated above, if online print and scan jobs are initiated, theoretically, all kinds of personal data can be on the documents and thus be processed via the cloud! We have no influence on which documents are printed or scanned. Therefore, we have no influence on and accept no responsibility for the content of the documents or the personal data contained therein.
For cloud processing, we use Microsoft Azure Services, provided by Microsoft Ireland Operations, Ltd., located at One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
It is important to mention here that only regionally-based data centers are used for document processing.
For more information on data processing by Microsoft, please refer to the following privacy statement:
https://privacy.microsoft.com/en-us/privacystatement
The use of this service provider is based on Art. 6 para 1 lit. b GDPR, insofar as your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in the effective processing of the print and scan jobs addressed to us or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
4.2 uniFLOW Online logging
uniFLOW Online Service logs
uniFLOW Online automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
This data is not merged with other data sources.
The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The provider has a legitimate interest in the technically error-free presentation and optimization of the website - for this purpose, the server log files must be collected.
Scanning with Filing Assist
If the subscription "Advanced Scanning or Cloud Image Processing" is activated (higher subscription), certain data may be processed by our service provider Canon Inc., located at 30-2, Shimomaruko 3-chome, Ohta-ku,
Tokyo 146-8501, Japan (over Microsoft Azure Cloud) in the course of Optical Character Recognition (OCR) processing for certain scanning functions so that the function can be performed in accordance with the NT-ware's online subscription terms.
The following personal data may be processed in the course of scanning with Filing Assist:
Personal data may only be accessed by the above-mentioned service provider if a support case is requested by the customer to NT-ware. Personal data is deleted within 14 days and only retained and limited to support services.
For this cloud processing, Canon Inc. uses Microsoft Azure Services, provided by Microsoft Ireland Operations, Ltd., located at One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
It is important to mention here that only regionally-based data centers are used for document processing.
For more information on data processing by Microsoft, please refer to the following privacy statement:
https://privacy.microsoft.com/en-us/privacystatement.
The use of this service provider is based on Art. 6 para 1 lit. b GDPR, insofar as your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.
We have concluded a data processing agreement (DPA) with Canon Inc. This is a contract required by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and compliance with the GDPR.
Device and client-side application (uniFLOW SmartClient) Diagnostic Trace Logs
Once enabled, the Trace Logs are sent to us directly.
This detailed developer-level log information contains application data at various steps in the execution of the source code.
Application data could be:
The above data processing is for support purposes to gather detailed developer-level log information.
The processing of the above data is based on Art. 6 para 1 lit. b GDPR, insofar as your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
4.3 Sales & Support Channel Information
Chat function
Your Canon Certified Service team has access to a chat facility built into uniFLOW Online Portal UI and may use this to get support during the installation and configuration of your tenant. We use the service provider Userlike UG (haftungsbeschränkt) located Probsteigasse 44-46, 50670 Cologne, Germany.
The following data may be processed when using the chat function:
For more information on data processing by Userlike, please refer to the following privacy statement:
https://www.userlike.com/en/data-privacy
The use of this service provider is based on Art. 6 para 1 lit. b GDPR, insofar as your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in the effective processing of the communication with the user and the customer or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract required by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
NT-ware Customer/Support Portal Registration (exclusively reserved for Canon directly or Canon partners)
We offer users the possibility to register for our NT-ware Customer/Support Portal by providing personal data. The data is collected by means of Microsoft Forms.
By submitting the form, the following personal data will be collected for the purpose of the registration process:
The processing of this data is based on Art. 6 para 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in the effective processing of the inquiries addressed to us and to collect the information required for registration for the NT-ware Customer/Support Portal via an appropriate, reliable and secure platform or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.
The data you send to us will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after you have canceled your account or are no longer authorized to use this account). Mandatory legal provisions - in particular legal retention periods - remain unaffected.
4.4 Inquiry by email, telephone, or fax
If you contact us by email, telephone, or fax, your inquiry, including all personal data resulting from it (e.g., name, telephone number, email address, country), will be stored and processed by us for the purpose of processing your request.
The processing of this data is based on Art. 6 para 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para 1 lit. f GDPR) or on your consent (Art. 6 para 1 lit. a GDPR) if this has been requested.
The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g., after we have completed processing your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.
4.5 Cookies
uniFLOW Online uses so-called "cookies". Cookies are small text files and do not cause any damage to your end device. They are stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your end device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or until they are automatically deleted by your web browser.
In some cases, cookies from third-party companies may also be stored on your terminal device when you enter our sites (third-party cookies). These enable us or you to use certain services of the third-party company.
Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them.
Cookies that are required to carry out the electronic communication process or to provide certain functions that you have requested (e.g., for displaying videos) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies has been requested, the storage of the cookies in question is based exclusively on this consent (Art. 6 para. 1 lit. a GDPR); consent can be revoked at any time.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If you deactivate cookies, the functionality of this website may be limited.
Insofar as cookies are used by third-party companies or for analysis purposes, we will inform you separately about this within the framework of this privacy notice and, if necessary, request your consent.
Further information on the cookies used on this website is set out in our Cookie Policy.
Furthermore, links from external providers (e.g., PlayStore) or links to other websites for which NT-ware is responsible may be available on the website. If you do not want information about you to be collected through these websites, please do not click on these links or ensure that you only enable the cookies that you agree to use as part of the cookie settings on the relevant website.
5. Data exchange with other NT-ware subsidiaries
Unless otherwise stated in this privacy notice, personal information is for internal use only and will not be disclosed to third parties. Notwithstanding the foregoing, information in the context of uniFLOW Online support requests may be shared with other NT-ware Group companies, namely:
These are primarily support requests submitted to us by you, the customer of uniFLOW Online, or a respective Canon dealer (via the ITS support system).
These support requests may contain personal data like user names, email addresses, and, if documents were attached to the ticket, potentially any kind of personal data which is stated in the document. We have no influence on which documents are shared. Therefore, we have no influence on and accept no responsibility for the content of the documents or the personal data contained therein.
If the processing of your request has a (pre-)contractual background, we rely on Art. 6 para. 1 lit. b GDPR for the transfer (if this is necessary) of your personal data.
Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
We have concluded a data processing agreement (DPA) with the above-mentioned subsidiaries. This is a contract required by data protection law, which ensures that they only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
Standard contractual clauses have been concluded with the subsidiaries in the USA and Singapore as an appropriate safeguard for the exchange of personal data pursuant to Art. 46 para. 2 lit. c GDPR. We would like to point out that no level of data protection comparable to the EU can be guaranteed in these countries. As already mentioned, US companies, for example, are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this.
If personal data is exchanged with the subsidiary in Japan, the adequacy decision of the European Commission, pursuant to Art. 45 para. 3 GDPR will be relied upon. Such an adequacy decision means that the European Commission has decided that a transfer of personal data to a third country may be made because the third country in question offers an adequate level of protection.
6. Data exchange under special circumstances
In the event of an acquisition of NT-Ware or substantially all of its assets, customer information may be one of the transferred assets. In addition, in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all of our business, assets, or shares (including in connection with a bankruptcy or similar proceeding), the personal information we process may be transferred to the relevant third party.
7. Plugins and Tools
Google Maps
We use Google Maps (API) from Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google") on uniFLOW Online. Google Maps is a web service for displaying interactive maps in order to provide geographical information.
When the Google Maps function is used, information about your use of our website (e.g., your IP address) is transmitted to Google's servers in the United States and stored there. This happens regardless of whether Google provides a user account to which you are logged in or whether there is no user account. If you are logged in to Google, your data will be directly assigned to your account.
If you do not wish to be associated with your Google profile, you must log out of your Google account before activating the "Register" button for the test drive. Google stores your data (also for users who are not logged in) as usage profiles and evaluates them.
Pursuant to Art. 6 para. 1 lit. f GDPR, such an evaluation is based on Google's legitimate interests in the display of personalized advertising, market research, and/or the needs-based design of its website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise these rights.
Please note: Google LLC is based in the United States. Since the discontinuation of the EU-US Privacy Shield, an adequate level of data protection, such as can be assumed within the European Union, is no longer guaranteed for the United States.
If you do not agree to the future transmission of your data to Google when using Google Maps, you can also completely deactivate the Google Maps web service by switching off the JavaScript application in your browser. In this case, Google Maps and the map display on this website cannot be used.
You can find Google's terms of use at: https://policies.google.com/terms?hl=en.
Further terms of use for Google Maps can be found at: https://www.google.com/intl/en_US/help/terms_maps/.
For details on data protection in connection with the use of Google Maps, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=en.
Google reCAPTCHA
For the purpose of preventing so-called bots (machines/robot programs) from abusing certain interactions such as registrations on websites (e.g., through fake user attacks), we use Google reCAPTCHA (Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA) on some of our websites. Google reCAPTCHA tests whether it is a user/website visitor or a bot and thus enables access to the website.
When checking (activating the tool) whether it is a "human" user or a bot, the following personal data may be processed and forwarded to Google (transmission to the USA is also possible):
Google reCAPTCHA is used in the interest of the security of our websites and products. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR (among other things, prevention of spam). If a corresponding consent was requested, the processing is based exclusively on Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
PayPal
We offer the option of processing the payment transaction via the payment service provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). This corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6 para. 1 lit. f DSGVO). In this context, we may pass on the following data to PayPal insofar as it is necessary for the fulfillment of the contract (Art. 6 para. 1 lit. b DSGVO):
The processing of the data provided under this section is neither legally nor contractually required. Without the transmission of your personal data, we cannot carry out a payment via PayPal.
PayPal carries out a credit check for various services, such as payment by direct debit, in order to ensure your willingness and ability to pay. This corresponds to the legitimate interest of PayPal (according to Art. 6 Para. 1 lit. f DSGVO) and serves the execution of the contract (according to Art. 6 Para. 1 lit. b DSGVO). For this purpose, your data (name, address, date of birth, and bank account details) are passed on to credit agencies. We have no influence on this process and only receive the result of whether the payment has been made or rejected or whether a check is pending.
You can find more information about objection and removal options vis-à-vis PayPal at: https://www.paypal.com/us/legalhub/privacy-full?locale.x=en_US.
Your data will be stored until payment processing is complete. This includes the period required for processing refunds, claims management, and fraud prevention.
8. Changes
This privacy notice may be amended from time to time. You should therefore check the websites regularly for changes regarding the privacy notice. If necessary, we will inform you directly about such updates.
This privacy notice was updated in 2023.
© 2023 NT-ware Systemprogrammierungs-GmbH