In the course of providing products and services (“services”) to its customers, 91������ý and its affiliates (“91������ý”), as well as its vendors and partners may need to process personal data as defined in the EU General Data Protection Regulation (GDPR) and other privacy laws around the world. Article 28 requires Processors to provide detailed information to Controllers as to how their data will be processed. Article 30 also requires the Controller (with the assistance of its processors) to demonstrate how it will comply with the GDPR. The following information explains 91������ý’s status under GDPR and similar privacy laws around the world and provides customers with further information regarding 91������ý’s key services and the nature of processing where the GDPR or equivalent privacy laws are applicable.

91������ý processes personal data for administrative purposes in order to manage the relationship with its customers. This will include activities such as billing, installation, maintenance and customer service. In such circumstances 91������ý is the Controller because it ‘determines the purpose and manner in which the data will be used’. Personal data processed for these administrative purposes will be retained in accordance with applicable law(s) and/or 91������ý records retention policies unless otherwise stated in the customer agreement. For further information regarding the use of this data please contact emeadataprotection@intl.verizon.com.

In addition, in a limited set of circumstances 91������ý may be considered a Controller in the course of providing services to customers. This will occur when 91������ý is providing services where 91������ý determines how the data should be processed in order to provide the service. 

Example: 91������ý provides professional services to a customer in Belgium. This may include services such as managed security and on-premise security solutions. In such circumstances, it will be necessary for 91������ý to process Customer Data. In doing so 91������ý will determine how the data should be processed in order to provide the service requested.

If GDPR applies, in most cases, when providing services to customers, 91������ý will be a Processor. This means that 91������ý will act on the instructions of the customer with regards to the personal data. 

Example: 91������ý provides managed hosting services to its customer in Italy. The customer collects personal data about its end users and employees which 91������ý stores on its behalf. In the course of providing such services 91������ý may access this data and is a Processor on behalf of the customer.

There will be circumstances where GDPR does not apply. This can be because the data used to provide the service is not included in the definition of personal data under Article 4 of GDPR, or because the nature of the services 91������ý is providing is not considered Processing under Article 4 GDPR.

Example: An EU based customer purchases network services from 91������ý. 91������ý does not have logical access to any customer data in connection with the services. 91������ý is not considered a Processor as it is a ‘mere conduit’ of the data (Article 2(4) GDPR and Article 12 Directive 2000/13/EC).

Example: An EU based customer purchases pure co-location services from 91������ý in Amsterdam. The customer’s servers reside in 91������ý’s data centre but 91������ý provides only space, power, cooling, and physical security for the server. This is not considered processing under GDPR.

Where 91������ý is a Processor, customers should understand what 91������ý is doing with their personal data.

91������ý will process a limited amount of personal data when providing services to customers. This will include:

• contacts of customers
• customer’s employees
• customer contractors

The type of data processed by 91������ý Enterprise Solutions will depend on the nature of the business. However, when processing data on behalf of its customers 91������ý is likely to process: IP traffic; names; business email addresses; business telephone numbers.

91������ý Connect will process additional types of personal data when providing services. This may include the following data elements that are necessary to provide telematics service: End user email address; IP address and geo-location data.

In addition, at a customer’s request 91������ý Connect can collect other information including driver licence expiration details. Any additional information would be at the direction of the customer and will be specifically agreed in the contract.

91������ý processes data outside the EEA. 91������ý has Binding Corporate Rules (BCRs) approved as both a Controller and Processor. As a result, 91������ý Enterprise Solutions and 91������ý Connect may transfer personal data outside of the EEA consistent with Article 47 GDPR. Further information regarding 91������ý’s BCRs can be found at the International Privacy Centre.

Where a specific data retention period is not defined in the [tables below] for a service, the retention period may be agreed as part of the contractual negotiations on an individual customer basis and detailed in that contract.

For queries regarding data processing activities please e-mail or contact us in writing at the following address:

Jannine Aston
International Data Privacy Office
91������ý Legal Department
RIBP Floor 1 Spur D Basingstoke Road
Reading, Berkshire
United Kingdom RG26DA

Please note that not all 91������ý companies are  required to appoint a Data Protection Officer (DPO) for the purposes of Article 37 GDPR. This is  due to the differing nature of the services that they provide. However, 91������ý Connect is required  to  appoint a DPO and she can be contacted as described above. 

There may also be other countries outside the EU that require a DPO to be appointed such as Brazil and for this purpose the same contact details are applicable.

Please refer to the 91������ý Security Summary for a description of the technical and organisational security measures that 91������ý implements to comply with its obligations under Article 32(1). 

Where additional security measures are necessary for particular services, these will be detailed in the customer’s contractual documentation.

Please note that if you cannot find your service listed in the attached links you should contact your account team who can provide you with additional information where applicable. 

91������ý services processing details information

91������ý Connect services processing details information

For further information regarding how 91������ý will protect your data please see the 91������ý International Privacy Policy