“Contract Data” means Personal Data about our customers’ customers or our customers’ personnel that NCR Processes in connection with providing products and services to a customer under a customer contract. Contract Data is a subset of “Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
“Personal Data” means information relating to an identified or identifiable natural person to the extent such information is afforded the protection of law. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the individual’s physical, physiological, mental, economic, cultural, or social identity.
“Process” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, blocking, erasure, or destruction.
“Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of a Controller.
“Special Categories” means, to the extent designated under applicable law, Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
NCR Customer Obligations with Respect to Contract Data
Collection of Personal Data
The Personal Data NCR may collect about you includes, but is not limited to, user IDs and passwords; demographic information; contact details, such as your name, address, email address, or telephone number; geo-location data; IP address; machine address or education or employment data.
You may provide Personal Data to NCR in a variety of ways, such as by registering for an online account or event, joining a mailing list, purchasing a product or service, applying for employment, filling out an information form, or otherwise contacting us with a question, comment, or request. Additionally, NCR may collect information about you or obtain Personal Data about you from third parties for the purposes of providing you with information about NCR products and services that may be of interest to you, or to take steps to maintain the accuracy of the information we have about you. NCR may also use certain technologies to collect information about you while you are visiting an NCR website, as described below.NCR will obtain Personal Data about you only by fair and lawful means, and will take steps designed to be transparent with you about the purposes for which such information is being collected and how NCR Processes that data.
With respect to Contract Data, it is our customers’ responsibility to ensure that NCR’s Processing of Personal Data we receive under our contract with them is consistent with the terms of our customers’ privacy policies.
Use of Personal Data
· With your consent, where consent is required by law. You may always withdraw your consent to this processing at any time, however, doing so will not affect the lawfulness of NCR’s processing before your withdrawal of consent. Once you withdraw consent, we will no longer process your information for the purpose(s) to which you originally consented unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. In case we processed your Personal Data for direct marketing purposes, you have the right to object at any time, in which case we will no longer process your Personal Data for such marketing purposes.; or
· Where reasonably necessary to fulfill NCR’s business needs, including to:
· Perform a contract with you or take steps at your request prior to entering into a contract;
· Comply with a regulatory or legal obligation;
· Protect your vital interests or that of another natural person;
· Perform a task carried out in the public interest;
· Further a legitimate interest of NCR or a third party including but not limited to:
· Researching and developing products, services, marketing or security procedures to improve their performance, resilience, reliability or efficiency;
· Protecting NCR personnel, property and assets from threats or harm including to NCR’s information technology infrastructure, Intellectual property, or goodwill or reputation;
· Ensuring compliance with relevant corporate policies;
· Optimizing utilization of global corporate resources including the administration of business transactions, personnel and information technology systems.
With respect to Special Categories of Personal Data, NCR may Process such information in a manner that is consistent with applicable law and:
· With your explicit consent for one or more specified purposes. You may always withdraw your consent to this processing at any time, however, doing so will not affect the lawfulness of NCR’s processing before your withdrawal of consent. Once you withdraw consent, we will no longer process your information unless there is a lawful reason for us to do so. One example where we may be permitted by the law to continue processing your information would be to pursue or defend a legal claim; or
· Where Processing:
· is necessary to carry out our obligations and exercise our rights as an employer; or
· is necessary to protect your vital interests or those of another person, and where you are physically or legally incapable of giving consent; or
· relates to Personal Data that you have manifestly made public; or
· is necessary for NCR to pursue or defend legal claims or where a court compels us to do so; or
· is necessary for reasons of substantial public interest; or
· is necessary for the purposes of the assessment of your working capacity.
In most cases, we will seek Personal Data from you to provide you with information, products or services or for the purposes of entering into or performing a contract. At other times, we may be required by law to seek the Personal Data. In either event, we will strive to be transparent with you as to the purposes of collection and whether providing the information is voluntary and what the possible consequences would be if you chose not to do so.
NCR may combine Personal Data it obtains about you from various other sources to help us improve its overall accuracy and completeness, and to help us better tailor our interactions with you.
NCR will retain Personal Data only for so long as it is necessary to support the overall purpose(s) for which NCR collected such information plus any further period as may be required or reasonably necessary for record keeping, analysis or to meet legal or regulatory requirements. We take steps to minimize access, use and retention of Personal Data for such ongoing retention to what is reasonably necessary. To determine the appropriate retention period for your Personal Data, we will consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
NCR’s use may include, but is not limited to, making sales calls, sending marketing communications, delivering or completing requested services or transactions, and tracking and analyzing a series of transactions.
NCR will use Contract Data consistent with applicable contractual obligations and applicable law. NCR also may use Contract Data to facilitate compliance with regulatory and legal requirements.
For anonymised or aggregated data which was formerly Personal Data but which can no longer identify individuals, NCR may conduct research and development, statistical, trend or pattern analysis in order to continuously improve our products, services processes and security procedures.
Fulfilling Business Transactions - NCR may use your Personal Data to fulfil business transaction requests with you or your organization. With respect to our customers, such requests may include, but are not limited to, providing products or services including delivering notifications of product issues, fixes or updates, or contacting you in response to your questions, comments, or requests. With respect to our suppliers, such requests may include issuing purchase orders, receiving invoices, or providing other information such as forecasts. If, in providing service or support (including support to assist you with the use of our websites or applications), we engage you telephonically or via electronic communications through tools such as email or online chat, we may monitor or record our interactions for purposes of quality assurance, training, or to document the details of the interaction or transaction.
NCR is a global company with global operations, partners and suppliers. Where it is necessary for the efficient and effective performance of a business transaction or the fulfilment of one of the uses of Personal Data outlined above, NCR may need to transfer Personal Data from the country of collection to another country or even in some cases, ‘onward transfers’. Where such a transfer is made from one country or territory to another which is not deemed by the first exporting country (“Exporting Country”) to offer an adequate level of protection to the rights and freedoms of data subjects, NCR’s policy is to do so on the basis of contractual controls between the relevant group companies, partners or suppliers designed to ensure that substantially the same level of protection is afforded to the Personal Data as in the Exporting Country. NCR’s contractual safeguards are based on the ‘standard contractual clauses’ issued by the European Commission or other data protection regulatory authority as appropriate for the law of the Exporting Country.
Disclosure of Personal Data
We may share Personal Data with third-party suppliers and service providers that help us Process Personal Data. Examples of categories of suppliers include: HR service providers (such as payroll providers, background verification providers, benefits providers, and document management providers), IT vendors, including security product providers, email providers and application providers, contingent workers, and consultants.
It is NCR’s practice to enter into contracts with our suppliers and service providers that require them to handle your information in a manner consistent with NCR policy and applicable law.
NCR also may provide information that identifies you at an individual level to third-party business partners, such as resellers. NCR does not, however, sell or rent such information to these third parties.
From time to time, NCR may contemplate entering into various business development activities which may include the sale, purchase, merger, or reorganization of one or more of its businesses. These business development activities may require the disclosure of Personal Data to the prospective or actual purchaser(s). When such disclosures are required, NCR will seek appropriate protections of your Personal Data.
In certain circumstances, NCR may use or release Personal Data to third parties when disclosure is required by law (e.g. statute, judicial proceeding, court order, or subpoena). We also reserve our right to use or provide your Personal Data to third parties, including law enforcement, auditors, consultants, and government officials, to protect NCR’s rights or property, and/or the rights or property of our customers, business partners, suppliers, or other third parties.
Setting Your Privacy Preferences and Opting Out
With respect to Contract Data, the NCR customer is responsible for obtaining consent and, where applicable, processing opt-out or unsubscribe requests.
Accessing and Maintaining the Accuracy of Your Personal Data
NCR strives to maintain the accuracy of any Personal Data we collect about you and to Process only the Personal Data that is relevant and limited to what is necessary for the purposes for which the information is Processed. We provide several mechanisms to allow you to:
· Access Personal Data about you consistent with legal requirement. In addition, you may have the right in some cases to receive or have your Personal Data transferred to another party. Where permitted by law, NCR may charge a reasonable fee if we are required to provide information about you.
· Request correction of your Personal Data where it is inaccurate. In some cases, NCR may provide self-service tools that enable you to update Personal Data about you.
· Request deletion of your Personal Data where required by law.
· Request restriction of Processing of your Personal Data where such requests are permitted by law. NCR will notify you before we begin to process any information about you that was restricted just prior to processing.
Before acting on a request to do any of the foregoing, NCR will take reasonable steps to verify your identity.
With respect to data controlled by third parties, such as Contract Data, the third party is responsible for maintaining the accuracy of the Personal Data it collects and Processes. Requests to access, correct, restrict or delete Personal Data controlled by third parties (such as Contract Data) must be directed to that third party.
Right to Object to Processing
We value the trust you place in us by sharing your Personal Data with us as we strive to improve our products, services and processes. If you have any concerns about the way in which we process your Personal Data, please contact us for clarification.
If you are subject to certain laws, for example, the EU General Data Protection Regulation, you may also have specific rights to object to processing of Personal Data about you, for example, when we Process your Personal Data on the basis of the ‘legitimate interests’ grounds outlined above. We will respect your choice unless we have a compelling interest overriding your objection.
Similarly, where we process your Personal Data for the purposes of direct marketing (including profiling to the extent that it is related to such direct marketing), you have the right at any time to object to such processing.
Use of Automated Individual Decision Making including Statistical Analysis and Profiling
NCR may use statistical and analytic techniques to support automated individual decision making including profiling for the purpose of improving the quality, performance or efficiency of our products, services or processes or to screen applicants for employment, to facilitate compliance with law or policy, or to protect our information technology infrastructure. We take reasonable steps to be transparent with you about the nature of that processing and to protect your rights and freedoms in cases where we use automated processing.
As described in more detail below, NCR websites may employ a variety of tools to help us improve your experience on our websites and determine the effectiveness of certain of our marketing initiatives.
Where required by applicable law, NCR will only place cookies on your device with your consent (which you may withdraw at any time). Your consent may also be indicated by your internet browser’s settings if they are set to “automatically accept cookies.” Most browsers, however, permit users to change these settings either to refuse all cookies or to selectively accept them. If you would like to change your browser’s cookie settings, please refer to the online help offered with your browser or to your device manufacturer’s website. Please note, however, if you decide to turn off cookies, there may be some features of our websites that may not be available to you and some pages may not display properly. To learn more about managing cookies on your device, please visit http://www.allaboutcookies.org/manage-cookies/.
Other Technology NCR May Use to Improve Your Experience.
NCR, and our service providers, may also use other technology to improve your experience. As described below, these technologies include analysis tools, log file information, web beacons, web links, and local shared objects.
Log File Information - NCR records log file information whenever you access our websites. Examples of log file information include your IP address, your browser type, the page from which you accessed our website, the pages you viewed while visiting our website, the last page you viewed before you exited our website, and the page you accessed after leaving our website. We use this data in the aggregate and do not use it to identify you individually.
Web Beacons, Pixel Tags, Clear GIFs and other technologies - These technologies involve placing electronic (and usually transparent) images on a website or in an email. These images place certain information on your device such as cookies, the time and date of a page you viewed and the length of time you viewed the page, the IP address of the device that retrieved the image, the time the web beacon was viewed and for how long, and the type of browser that retrieved the image. We may use these technologies, for example, to determine whether you have opened or accessed links included in marketing communications from NCR. These technologies often work with cookies; therefore, if you do not want us to associate your cookie information with your visits to our website, you must turn off cookies in your browser.
Web Links - Emails from NCR may contain links that are designed to take you to a web page after redirection through NCR’s servers (or those of its suppliers). We use the information we obtain during the redirection process to determine whether a particular marketing initiative is effective, and may collect information connected to your identity. If you do not want NCR to collect information about the links that you click, you can choose a text-based version of the message (if the option is available). You may also choose not to click the links we provide in the emails we send to you and search online for the relevant resource independently.
Local Shared Objects (“Flash Cookies”) - NCR may use Adobe Flash Player® to deliver multimedia content, such as a video, to you. To improve your user experience, NCR may use Flash local shared objects (LSOs) – sometimes called “flash cookies” – to store your flash content information and preferences, similar to other types of cookies NCR employs. You can manage flash cookies by accessing the following link on Adobe’s website: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html.
Some browsers permit users to adjust browser settings or may contain add-ons to help you manage your ad choices. For more information about this choice, please refer to the online help offered with your browser or to the device manufacturer’s website.
You may opt out of third parties’ advertising networks. We have provided the following information to help you with this choice:
The Network Alliance Initiative and the Digital Advertising Alliance websites offer opt-out tools to assist you in managing your choices for participating companies. For more information about these tools please visit the NAI Opt-Out Page and the DAA Opt-Out Page.
Please note that, even if you exercise your choices, you may still receive generic, non-targeted ads from NCR.
Protection of Your Personal Data
NCR’s applications and websites are not directed to, nor do we knowingly collect Personal Data from, children under the age of 16. By your use of our websites you affirm that you are at least 16 years of age. NCR does not knowingly solicit data from or market to children under the age of 16. If you are a parent or a guardian, and you believe your child has provided NCR with Personal Data without your consent, please contact us.
We reserve the right to update this privacy notice at any time, and we will make an updated copy of such privacy notice available on our website. When we make any revisions that materially change the ways in which we use or share the Personal Data previously collected from you, we will give you the opportunity to consent to such changes before applying them to that Personal Data.
Changing Your Preferences and Contacting Us
You may change your marketing preferences by clicking here.
NCR strives to be transparent with our data handling practices, and we welcome any questions or concerns you may
have. You may contact us as follows:
Outside of the European Union
Chief Privacy Officer
c/o Law Department
864 Spring St. NW
Atlanta, Georgia 30308
Within the European Union
Group Data Protection Officer (EU)
c/o NCR Limited
5 Merchant Square
If NCR does not satisfactorily address your concerns and you are subject to the European Union’s General Protection Regulation, you have the right to lodge a complaint with your Supervisory Authority.