Personal Data Handling Information at Toshiba America Energy Systems Corporation and its subsidiaries (collectively, “we,” “us” or “our” or “Toshiba”).
At Toshiba, our Data Privacy and Records Management Policy is a commitment to protecting the personal data of employees, clients, business partners and web and social media site visitors. This Policy guides our personal data handling practices as described here in this Frequently Asked Questions (FAQ) format. Toshiba makes every reasonable effort to protect the privacy of personal data collected when individuals visit our sites.
Toshiba policy and practice is also guided by the General Data Protection Regulation (GDPR) of the European Union (EU), other country or U.S. state laws like the California Consumer Privacy Act (CCPA), and other U.S state laws.
If you are under 18 years of age we request you obtain parental consent before posting a comment on our blogs and sites. Our websites do not publish content for or collect data that is directed at children.
Contacting Toshiba and more Information about Data Privacy Practices
Contact information is provided at the end of this page.
As a Toshiba web site visitor, what information does Toshiba collect?
When you visit the Toshiba web site, we collect and store information about your visit. We may also engage other companies to do this on our behalf. Examples of the kind of information we, or third parties we engage, track include which pages you view on our site, the site you visited just before coming to ours, keywords you used in your search, the IP address from which you visited our site, your company name and the name of your Internet Service Provider. We use this information to develop ideas for improving our site, our products and services and for improving marketing of our products and services. We do not make any attempts to link this information with you as an individual.
There are also various forms on our web site that ask for personal information about you, such as your name, phone number, and e-mail address. If you tell us any personal information, we use it only to contact you in response to your request or to provide you with information that we think you may be interested in receiving. If you inform us that you do not want to receive any information that you have not specifically requested, we will honor your request. We will not sell or otherwise disclose your information to any other company.
Toshiba employs professional security personnel and takes technical and organizational measures designed to prevent unauthorized access, use, alteration, or disclosure of personal data collected via Toshiba sites. We try to be both selective and proactive in checking the security background for certain external social media sites and other sites that we come in contact with but do not control. Security practices are described in detail in our internal information technology (IT) policies and procedures. Also see our information security practices IT Fact Sheet below for more information.
As a Toshiba site visitor does the “GDPR”, “CCPA”, and other similar data privacy and records management requirements apply to my data?
Companies within the EU and California, or who are externally located controllers and processors of the personal data of EU and California residents in the context of collecting personal data while soliciting and providing goods or services, must comply with the GDPR and CCPA. As a Toshiba site visitor we do collect your business contact information. However, we may also collect or process personal data for the purpose of providing additional services. We are very aware that combining multiple personal data elements, even if not considered personal data per se when taken alone, may result in the sum of the elements being considered personal data when combined into a listing, and we protect it as required.
Toshiba may move your data within or to locations outside of the European Economic Area (EAA) or California. These data transfers are legal under the GDPR, and the CCPA as long as we adhere to the requirements for legal processing. We encrypt all data in transit using SSL (HTTPS URLS) and in storage (encryption at rest).
Toshiba has evaluated our obligations under the GDPR, CCPA and other laws like the CCPA, in part, based on: (1) the type of visitor data that we collect via our sites, and (2) the legal basis on which you rely for the protection of your data. We will exercise data privacy stewardship on all of our sites.
How will my personal information be used and shared by Toshiba for internal management of the sites?
The personal information we collect in our various sites, if needed, allows us to:
- Respond to your inquiries;
- Provide the information, products and services you have ordered;
- Verify your identity and details of your payment method or credit card amount where applicable;
- Administer our sites and provide user services;
- Meet legal, regulatory and compliance requirements;
- Monitor and analyze the use of any account to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents, public safety threats to you or crime;
- Gather management information to form statistical and trend analysis;
- Communicate with you;
- Investigate any complaints about our sites;
- Personalize your experience of the sites;
- Contact you about our products and services which we think might be of interest to you (where we have the appropriate permissions to do so);
- When warranted, we share your personal information with our Toshiba affiliate companies and brands for the above purposes; they adhere uniformly to these data handling practices;
- Employ the services of third party service providers to help us in certain areas, such as site hosting, maintenance and call center operation. In some cases the third party may receive your information. However, at all times we use third parties, we will contractually control and be responsible for the use of your information and place contractual requirements on personal data sent to our sub-processors by putting in place data processing agreements with these service providers.
- If you provide a credit or debit card, we may also use third parties to check the validity of the sort code, account number and card number you submit in order to prevent fraud as well as to process any transaction you attempt via the website.
- If false or inaccurate information is provided and fraud is identified, we will follow legal processes if details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We and other organizations may also access and use this information to prevent fraud and money laundering, for example when:
- Managing credit and credit related accounts or facilities
- Recovering debt
- Checking details on proposals and claims for all types of insurance
- Checking details of job applicants and employees when required.
Where does Toshiba store my personal information?
Toshiba stores personal data in data centers in the United States. These are certified centers which have one or more of the following: SOC 1 Type 2, SOC 2 Type 2, Lloyd’s Register (LRQA) and ISO (International Standards Organization) 27001. (SOC = Service Organization Controls reports (1-3) of the AICPA (American Institute of Certified Public Accountants). ISO 27001 is one of the most recognized worldwide information technology security standards. SSAE 16 and ISAE 3402 – 22451 and PCI – Data 2334 Security Standard (SSAE = Statement on Standards for Attestation Engagements (#16 & 18), PCI = Payment Card Industry-Data Security Standard ((PCI-DSS)).
What constitutes personal data?
Personal data is information related to a natural person (called a ‘data subject’ by the GDPR, a “consumer” in the CCPA and as otherwise differentiated by other laws) that can be used to directly or indirectly identify the person when not encrypted and used individually or in combinations to create a profile.
Personal data includes a very broad range of personal information and can be any information item that might be used to create a profile, to include basic business contact information of name, business address, and business phone and business title or business job. Further personal privacy information would also be: an identifiable photo; identifiable voice recordings; fingerprints; biometric data; psychological profile, a personal email address, home phone number, home address; numbered identifiers – bank account, credit information and credit card, passport, country identification, driver’s license, pension and social security numbers; family member information; medical information; political opinions; sex, sexual preferences; computer IP address; data on children; travel profiles; trade union membership; criminal records. Some countries differentiate some of these listed items as Sensitive Personal Identification Information (SPII).
What is the difference between a data processor and a data controller?
- A controller is the entity that determines the purposes, conditions and means of the processing of personal data. A controller can be a processor. A web site owner is a controller.
- A data processor is an entity which processes personal data, with instructions and IT security framework, on behalf of the controller.
- Toshiba is a controller and/ or a processor at varying times in our conduct of business.
Is Toshiba a data processor or data controller in regard to my personal data?
Toshiba acts as a data controller and in some cases is also a processor (or sub-processor) for personal data provided to Toshiba through our customers, by individuals and other third parties such as business partners.
If a data subject (consumer) provides their personal data directly to Toshiba (such as a site visitor, a forum or conference attendee, a site browser, etc.) Toshiba acts as the data controller for that personal data. Note, if Toshiba also processes that personal data in some fashion, Toshiba also qualifies as a data processor in regard to that personal data.
Is Toshiba organized to manage the data processor obligations imposed by the GDPR, CCPA and other similar laws and regulations?
Toshiba established a Data Protection Policy and Records Management (DPRM) policy and procedure and complies with the GDPR, CCPA and other applicable laws.
For Toshiba, keeping site visitor and all data secure is a high priority. Along with ensuring data security, it is important that a site visitor’s confidence is always maintained and a high level of security around processes and protection is strongly administered.
At Toshiba, we strongly value and base our business on the trust that our site visitors, employees and customers have placed upon us. We will continue to earn and reinforce that trusted relationship by cooperating with requests related to our GDPR, CCPA, and other country data privacy obligations.
Toshiba is committed to taking advanced measures to support and continuously enhance the security of our systems, to ensure that we collect and process personal data in a manner compliant with GDPR, CCPA or any similar legislation.
Toshiba management strongly believes that information technology security/ compliance is a key business service. Information security objectives and strategy must be continually aligned with Toshiba’s business strategy and objectives.
When does Toshiba delete this personal data?
Toshiba deletes client data, including backups based on our records management policy. In some cases that can be shortly after you leave one of our sites. Web and social media privacy information is deleted after you finish browsing or have opted out of receiving our communications or you have been unresponsive to our inquiry messages for a period of time. If you acknowledge our site use rules to continue browsing or you agree when specifically requested to opt-in your information is transferred to our secure customer relations management database.
To meet business operations, contractual and statutory requirements we are legally and /or contractually required to keep some data for more extended periods of time consistent with the lawful processing provisions of the GDPR, CCPA or any applicable legislation. Data is held in various categories in our records management deletion schedules. These data retention categories range from nearly immediate up to seven (7) years unless there is a longer legal requirement. For more information about data retention times please contact Toshiba at ____________.
Does Toshiba provide clients with the option to delete personal data?
Toshiba supports the deletion of client data. However, we prefer such requests to be in writing and made in cooperation with the Toshiba staff. This will ensure clarity of the request in the event it is not a temporary storage item like non-persistent web and social media cookies.
What are Toshiba site cookie practices?
You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Disabling cookies on your internet browser will stop tracking of any part of your visit to pages within this site. Disabling cookies will usually result in also disabling certain functionality and features of this site. All traffic (transferal of files) between the site and your browser is encrypted and delivered over the HTTPS security protocol.
The types of cookies Toshiba may place on your device are described below.
- Toshiba will read or set only the types of cookies that are strictly necessary for quality browsing or specifically allowed by your browser preference settings.
- Toshiba only places cookies that set your preferred language, deliver specific content based on visit history, and give access to various sections of the sites.
- Cookies set by our sites will remain on your device but Toshiba will not access or use those non-strictly-necessary cookies. You may remove them using functionality provided by your browser. Please note that cookies are specific to the browser or device you use, as well as to the domain, and you will therefore have to configure your preferences again if you change your browser or device, or visit a different domain.
Forms related cookies
When you submit data to through a form such as those found on contact pages or comment forms cookies may be set to remember your user details for future correspondence.
Third Party Cookies
This site uses Google Analytics which is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content.
For more information on Google Analytics cookies, see the official Google Analytics page https://policies.google.com/technologies/types.
We also use social media buttons and/or plugins on this site that allow you to connect with your social network in various ways. For these to work the following social media sites including LinkedIn, Facebook, Twitter & YouTube will set cookies through our site which may be used to enhance your profile on their site or contribute to the data they hold for various purposes outlined in their respective privacy policies.
How do you use Web Beacons?
Some of our web pages may contain electronic images known as web beacons (sometimes known as clear gifs) that allow us to count users who have visited these pages. Web beacons collect only limited information which includes a cookie number, time and date of a page view, and a description of the page on which the web beacon resides. We may also carry web beacons placed by third party advertisers. These beacons do not carry any personally identifiable information and are only used to track the effectiveness of a particular campaign.
How do you use Social Media Widgets?
How do you use Contact Forms and Email Links?
Should you choose to contact us using a contact form on our sites or an email link, the data you supply will be stored in our customer relationship management database or may be passed on to be processed by a third party data processor(s) or may be sent an internal affiliated subsidiary/ organization for response. We do retain information from data requests in our customer relationship management system. Collated and transferred data is encrypted before being sent across the internet. We do not sell personal information.
How do you use information we provide to you?
As a compliance philosophy Toshiba makes every effort to apply a data minimization approach in our privacy data gathering and storage activities. We do collect and hold some personal information you give us. These are the general types of information we may collect from you:
Registration and Profile Information
We try to gather only the most necessary information for the involved inquiry or purpose. When you enter or register to use our site, our services, to receive information, to participate in our events, and create or update your forum profiles, we may collect various kinds of information about you. For example, we may collect: your name; postal address; phone number; fax numbers and email address; your log-in ID and password; your title; company; and other event specific profile information you provide; demographic information; and information linked with your profile such as comments you may post. We need this information to be able to respond to you, secure the site and provide services as applicable.
Information We Automatically Collect
- When you visit our site or use Toshiba site services, as do many companies, some information is collected and recorded automatically such as your computer’s operating system, Internet Protocol (IP) address, access times, browser type and language, and the website you visited before our corporate sites, so we are aware of transfers and linking for security due diligence (blocking and enhancing) of our site and to protect you the user. This is logged automatically and stored in log files. We also collect information about your usage and activity on our corporate sites. We may tie your IP address to information we automatically collect on our corporate sites. We may also tie information we automatically collect with personal information, such as your login ID and information you give us for a registration. We use our own products, and products of third parties acting on our behalf, to analyze, optimize, securely protect and improve our site.
- Toshiba will also collect information on your usage to ensure the security of the data we collect on behalf of our clients. You cannot opt-out of this collection and processing as it is necessary to ensure the security of the service we provide for our sites and for our clients.
- Toshiba may also use device-recognition technologies combined with other identifiers to create cross-browsers and cross-devices identities to provide you with better services and security.
In Toshiba’ Commitment to data protection what steps have been taken to protect my data?
Toshiba initiated a data privacy data management compliance review and update effort to ensure alignment with the requirements of the European Union (EU) General Data Protection Regulation (GDPR) and other similar privacy data regulatory obligations coming into force around the world like Privacy Shield and the California Consumer Privacy Act (CCPA). These efforts are Companywide, ongoing and driven by a by senior corporate leaders. We meet regulatory requirements, to include these examples:
- We have not identified any information technology shortfalls in data privacy transmission and storage encryption.
- Personal data owners’ storage information submissions are being continuously catalogued and updated.
- Standard contract language amendments for subcontractors/processors are in use.
- We conduct employee data privacy awareness training annually.
In addition Toshiba employs security professionals and takes technical and organizational measures designed to prevent unauthorized access, use, alteration, or disclosure of privacy data collected via Toshiba sites.
California Consumer Privacy Act (CCPA)
What is considered “personal information” under the CCPA?
“Personal information” is defined in the California law. CCPA categories are expanded beyond those in the EU General Data Protection Regulation (GDPR). In the law, personal information is any “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with any particular consumer.” “Consumer” is a defined term in the CCPA similar to “data subject” as used in the GDPR, however it is not an exact matching definition.
As a California citizen does Toshiba sell my data?
Toshiba does Not Sell or Buy Personal Information and has no intent to start. This “sale of consumer privacy data” element of the CCPA (and its regulations) is a major section that has limited impact on Toshiba due to our Policy position.
Does Toshiba honor the “rights” of consumers in the CCPA?
THIS POLICY APPLIES TO THE FOLLOWING SITES: