Last change: April 2025
UTAX Cloud Information Manager – Privacy statement
TA/UTAX Cloud Information Manager - Data protection information in compliance with Article 13 of the General Data Protection Regulation (GDPR)
TA Triumph-Adler GmbH (‘TA’, ‘we’ or ‘us’), located at Südwestpark 23, 90449 Nuremberg, Germany, has issued this Privacy Statement (“Statement”) to inform you, the user of UTAX Cloud Information Manager (‘UTAX CIM’), about the processing of your personal data when your organisation sets up a user account for you and when you download and use UTAX CIM on your device.
INTRODUCTION
UTAX CIM is a cloud-based document management system that enables organisations to store and easily retrieve documents using TA/UTAX CIM's indexing and enhanced search capabilities. Organisations can classify their uploaded documents and assign the correct attributes for indexing. Organisations can then search and retrieve these documents by entering text relating to either part of the content or the document's metadata.
The organisation using UTAX CIM is considered a data controller within the meaning of the GDPR and as such is responsible for the processing of your personal data. UTAX provides UTAX CIM as a data processor and processes personal data in accordance with our Data Processing Terms.
The organisation using UTAX CIM is considered a data controller within the meaning of the GDPR and as such is responsible for the processing of your personal data. UTAX provides UTAX CIM as a data processor and processes personal data in accordance with our Data Processing Terms.
A. Management of user accounts. UTAX processes a user's first and last name, username and email addresses that we have received either directly from you or indirectly from a UTAX customer (probably your employer or organisation) so that we can set up and manage a user account for you.
B. Provision of TA/UTAX CIM. In order to enable the user to use UTAX CIM as agreed, UTAX processes metadata about the files such as file names, document classification, viewing history, log files and the content of the respective files.
C. Remote Maintenance. A UTAX service technician can access your personal data processed in the local administrator's account to troubleshoot or solve problems.
D. Hosting. UTAX uses Google Cloud Platform, Belgium, as a provider of cloud storage.
B. Provision of TA/UTAX CIM. In order to enable the user to use UTAX CIM as agreed, UTAX processes metadata about the files such as file names, document classification, viewing history, log files and the content of the respective files.
C. Remote Maintenance. A UTAX service technician can access your personal data processed in the local administrator's account to troubleshoot or solve problems.
D. Hosting. UTAX uses Google Cloud Platform, Belgium, as a provider of cloud storage.
UTAX processes personal data for the above-mentioned purposes in order to fulfil its contractual rights and obligations pursuant to Art. 6 para. 1 lit. b GDPR towards its customers. To the extent that you as a data subject are not a party to the contract between UTAX and its customers, TA processes your personal data on the basis of its legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR, while UTAX's contractual obligations to provide UTAX CIM-related services constitute its legitimate interests.
We have carefully weighed your fundamental rights and freedoms against our legitimate business interests and continuously monitor the balance. However, should you wish to object to the processing of your personal data, please refer to the ‘Your rights’ section below. As the processing of personal data is necessary for UTAX to provide UTAX CIM, please note that your objection to the processing will result in you no longer being able to use UTAX CIM. Please note that in cases where TA processes personal data as a data processor on behalf of its customers, the customers are considered data controllers and as such are responsible for the processing of your personal data.
We have carefully weighed your fundamental rights and freedoms against our legitimate business interests and continuously monitor the balance. However, should you wish to object to the processing of your personal data, please refer to the ‘Your rights’ section below. As the processing of personal data is necessary for UTAX to provide UTAX CIM, please note that your objection to the processing will result in you no longer being able to use UTAX CIM. Please note that in cases where TA processes personal data as a data processor on behalf of its customers, the customers are considered data controllers and as such are responsible for the processing of your personal data.
Your personal data will only be shared with the following organisations:
- Google Cloud Japan G.K. for hosting services in Belgium
- KYOCERA Document Solutions Development America, Inc. (CA, USA) for remote maintenance services only in emergencies
- KYOCERA Document Solutions, Inc. in Japan for remote maintenance services
- KYOCERA Document Solutions Europe B.V., Germany Branch, for remote maintenance services
- To the extent we are required by law, regulation or court order to disclose your personal data, we may be required to disclose your personal data in accordance with such law, regulation or court order.
In the event that we share your personal data with a service provider (see above: Who do we share your personal data with?) that is based in a country that the European Commission considers does not provide an adequate level of protection under national law, we have ensured this adequate level of protection by agreeing additional appropriate safeguards with that group company or third party through the conclusion of standard contractual clauses as adopted by the European Commission. A list of countries that the European Commission considers to have ensured an adequate level of protection can be found here. You can request a copy of the standard contractual clauses by sending us an email explaining the reasons for your request.
Alternatively, we can ask for your explicit consent to the proposed transfer.
Alternatively, we can ask for your explicit consent to the proposed transfer.
Where possible, we have set specific retention periods for your personal data. These specific retention periods are specified below or we will communicate them to you at or before the start of the processing of your personal data. Where it is not possible for us to use fixed retention periods, we have set out below the criteria that we use to determine the retention periods.
Specific retention periods purpose (A) and (B).
We will retain your personal data in connection with your user account for as long as you have an active user account with us. If you do not activate your user account within 7 days of creating the account, we will delete it. We will also delete your user account if your organisation no longer uses UTAX CIM. Your personal data may be stored even after your account has been deleted if your organisation uses your personal data to identify documents.
Your organisation determines how long it stores the uploaded files in the system. As soon as an organisation's UTAX CIM account is deactivated, all data is deleted within 24 hours.
Purpose (C) Remote maintenance.
In the context of remote maintenance and support, UTAX may have access to personal data. Personal data processed for remote maintenance services will be deleted 7 days after the end of the services.
Criteria for determining retention periods
In all other cases, we use the following criteria to determine the applicable retention period:
Specific retention periods purpose (A) and (B).
We will retain your personal data in connection with your user account for as long as you have an active user account with us. If you do not activate your user account within 7 days of creating the account, we will delete it. We will also delete your user account if your organisation no longer uses UTAX CIM. Your personal data may be stored even after your account has been deleted if your organisation uses your personal data to identify documents.
Your organisation determines how long it stores the uploaded files in the system. As soon as an organisation's UTAX CIM account is deactivated, all data is deleted within 24 hours.
Purpose (C) Remote maintenance.
In the context of remote maintenance and support, UTAX may have access to personal data. Personal data processed for remote maintenance services will be deleted 7 days after the end of the services.
Criteria for determining retention periods
In all other cases, we use the following criteria to determine the applicable retention period:
- The assessment of your fundamental rights and freedoms
- The purpose(s) for processing your personal data. We will not retain your personal data for longer than is necessary for the purpose(s) for which we collected it.
- Any relevant industry practices or codes of conduct relating to the retention of personal data
- The level of risk and cost associated with retaining your (accurate and up-to-date) personal data
- Whether we have a valid legal basis for retaining your personal data
- The nature, scope and context of the processing of your personal data and our relationship with you
- Any other relevant circumstances that may apply
In any event, we will retain your personal data in accordance with applicable legal requirements and regularly review the personal data we hold.
We take the security of your personal data very seriously and make every reasonable effort to protect your personal data from loss, misuse, theft, unauthorised access, disclosure or alteration.
Further information on IT security measures can be found in the UTAX CIM security whitepaper.
Further information on IT security measures can be found in the UTAX CIM security whitepaper.
You have certain legal rights about which we would like to inform you. The processing of personal data is necessary to achieve the above purposes so that UTAX can fulfil its contractual obligations to its customers. If UTAX processes your personal data as a data processor, TA is obliged to contact the data controller before your request is realised.
Access. You have the right to be informed whether or not we are processing your personal information and to receive information about such processing.
Correction. You have the right to have your personal information corrected or completed by us without undue delay. If you have set up an account with us, you have the option of correcting or supplementing your personal information yourself.
Right to be forgotten. You have the right to have your personal information deleted by us without undue delay. This right is limited to certain grounds, e.g. if you have withdrawn your consent or if you object and there are no overriding legitimate grounds for us to continue processing. If you have an account with us, you have the option to delete your personal data yourself, in which case all your personal data will be permanently deleted. Alternative contact details must be provided to prevent the user account from being deactivated.
Restriction of processing. You have the right to request that we restrict the processing of your personal data for certain reasons. This concerns (1) the time we need to verify the accuracy of your personal data at your request, (2) that you request restriction of use instead of erasure of unlawful processing, (3) that you need personal data for legal proceedings or (4) that we verify whether our legitimate grounds override your objection to processing.
Right to object. You have the right to object at any time to the processing of your personal data where such processing is (1) based on our legitimate interest (including profiling you on the basis of your consent) or (2) for direct marketing purposes or (3) necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. We will stop processing your personal data based on your objection, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or if we need your personal data for legal proceedings.
Data portability. We are obliged to inform you of your right to receive your personal data from us so that you can transfer this personal data to another service provider.
Withdrawal of consent. If you have provided us with your personal data on the basis of your consent, you have the right to withdraw that consent at any time. You can do this by unsubscribing from the service you have subscribed to. You can also do this by sending us an email to the privacy email address below. We will then permanently remove your personal data from our database.
Submitting a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, about our processing of your personal data. A full list of supervisory authorities can be found here.
Access. You have the right to be informed whether or not we are processing your personal information and to receive information about such processing.
Correction. You have the right to have your personal information corrected or completed by us without undue delay. If you have set up an account with us, you have the option of correcting or supplementing your personal information yourself.
Right to be forgotten. You have the right to have your personal information deleted by us without undue delay. This right is limited to certain grounds, e.g. if you have withdrawn your consent or if you object and there are no overriding legitimate grounds for us to continue processing. If you have an account with us, you have the option to delete your personal data yourself, in which case all your personal data will be permanently deleted. Alternative contact details must be provided to prevent the user account from being deactivated.
Restriction of processing. You have the right to request that we restrict the processing of your personal data for certain reasons. This concerns (1) the time we need to verify the accuracy of your personal data at your request, (2) that you request restriction of use instead of erasure of unlawful processing, (3) that you need personal data for legal proceedings or (4) that we verify whether our legitimate grounds override your objection to processing.
Right to object. You have the right to object at any time to the processing of your personal data where such processing is (1) based on our legitimate interest (including profiling you on the basis of your consent) or (2) for direct marketing purposes or (3) necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. We will stop processing your personal data based on your objection, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or if we need your personal data for legal proceedings.
Data portability. We are obliged to inform you of your right to receive your personal data from us so that you can transfer this personal data to another service provider.
Withdrawal of consent. If you have provided us with your personal data on the basis of your consent, you have the right to withdraw that consent at any time. You can do this by unsubscribing from the service you have subscribed to. You can also do this by sending us an email to the privacy email address below. We will then permanently remove your personal data from our database.
Submitting a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, about our processing of your personal data. A full list of supervisory authorities can be found here.
UTAX has data protection experts, including a Data Protection Officer, who are available to assist you with your questions. If you wish to exercise any of your rights or have a question about this document, please contact us by e-mail or send us a letter to
TA Triumph-Adler GmbH
Attn: Data Protection Officer
Building 5
Deelbögenkamp 4c
22297 Hamburg
Germany
TA Triumph-Adler GmbH
Attn: Data Protection Officer
Building 5
Deelbögenkamp 4c
22297 Hamburg
Germany
Email: privacy@triumph-adler.net
If we make changes to this document, we will publish it on our website with a revised publication date and inform you of the revised document via your user account.