Privacy Policy

Introduction

Ribbon recognizes and supports the privacy rights of all persons, and we respect these rights when we collect and process personal information.  Ribbon has developed and adopted this Privacy Policy to describe and guide our processing of personal information.

In addition to the restrictions and obligations of this Policy, we always comply with the letter and spirit of applicable national laws that protect the privacy of personal information.

The obligations and responsibilities set out in this Privacy Policy are applicable to Ribbon and its personnel and will be made available on Ribbon's intranet and external website.   The obligations and responsibilities set out in the Privacy Policy are in addition to any other applicable policies or agreements entered into with Ribbon and any applicable national and local laws and regulations.  We continually monitor privacy, data protection and security laws and regulations as they apply to our operations worldwide.  In some cases, a country's data privacy and security laws may establish requirements which may diverge from our Privacy Policy.  If a country's law conflicts with our Data Privacy Policy, we follow the law.

This privacy policy has been layered and linked as shown below in order to allow readers to easily access specific elements of the policy.

Scope

EU GDPR Accountabilities

The Information We Collect or Process

Third Party Web Sites, Plugins or Widgets

Cross-Border Personal Information Transfers

Transfers of Personal Information from the EEA, UK and Switzerland to Other Jurisdictions

Recipients and Disclosures

Security and Integrity of Personal Information

Retention of Data

Choices and Accommodation

Data Subject Rights

Recourse, Complaints and Enforcement

Revision of Policy

Recent Revisions

Effective Date

Contact

 

Scope

This policy is global, applying to all Ribbon collection and processing of personal information. It applies to personal information regardless of format.  For example, the policy applies to computerized records and electronic information as well as paper-based files.

The concepts enumerated in this policy guide Ribbon's selection and expectations of its agents and subcontractors and other recipients to whom Ribbon transfers and relies on for processing of personal information.

EU GDPR Accountabilities

Ribbon provides certain services which are subject to the EU General Data Protection Regulation (EU Regulation 2016/679).

Data Processor

Ribbon's Kandy service provides the technology platform for hosted cloud information and communications services.  These services typically act as a conduit for data transmitted by third parties and subscribers.  Personal information processed in the above context is typically controlled by or originated from other companies, such as our customers, subscribers or other business partners.  While Ribbon does process data in its role of providing a technology platform, it does not own, control or direct the use of any of the personal information stored or processed by the above parties.

Ribbon also provides RibbonCare services to network operators which includes post-sales product technical issue resolution, installation and upgrade services which are described within this policy.

In the context of the above processing which is subject to the EU GDPR, Ribbon's accountabilities are those of a data processor as defined under Chapter IV of the regulation.   Accordingly, Ribbon relies on guidance and direction of the applicable data controller(s), who determine the purposes and generally the means of processing such personal information. 

Data Controller

In some cases, Ribbon may collect and process personal information for our own legitimate business purposes including:

  • Maintenance of communications with current or prospective customers, vendors, suppliers, resellers or partners
  • Direct marketing of Ribbon products and services

This notice contains information required under GDPR Articles 13 and 14 and details Ribbon's data controller accountabilities with respect to the above processing.  Ribbon is established in the EU in several Member States which are organized under the following EU entity:

Ribbon Communications International Limited
The Multis Building
Parkmore West Business Park
Parkmore, Co. Galway H91 X7Y3, Ireland
legal.privacy@rbbn.com

The Information We Collect or Process

Ribbon processes and in certain situations collects personal information as needed to deliver its products and services and manage its business.  When collecting or processing personal information, Ribbon does so in a lawful, fair and transparent manner. 

Ribbon must have a legal basis to process personal information.  In most cases the legal basis for processing will be one of the following:

  • where Ribbon is the data processor, the legal basis identified by Ribbon's customers or partners acting in their role as individual data controllers
  • where Ribbon is subject to a mandatory legal obligation
  • where Ribbon is permitted to carry out the processing under applicable law
  • performance of a contract or when preparing to enter into a contract
  • where Ribbon has a legitimate business interest which does not override the interests or fundamental rights and freedoms of individuals

When Ribbon collects or processes personal information, it does so in a proportionate and limited manner pursuant to relevant, appropriate, and customary purposes.   Ribbon will not share or disclose personal information for purposes other than as described herein. 

The types of information and the purposes for which Ribbon collects or processes personal information may include the following.

For Customers & Resellers

Contact, Marketing Lead and Service Portal Account Information

Ribbon may collect and use personal information about individual contacts of customers and others who access Ribbon public websites or provide personal information through other means.  Such information may include customer or subscriber account information, account identifiers, first/last name, company name, title and responsibilities, email address, business/mailing address, telephone numbers, job title as well as additional information provided by such individuals in the course of receiving products or services from Ribbon and/or requesting information about Ribbon.  We will use such information for the purposes of providing services, product support, conducting data analytics, product assessments and related activities, authorizing and extending credit and providing information regarding Ribbon products or services.

Unless expressly requested by Ribbon and consented by the contact, Ribbon will not share or disclose such business contact information to marketing firms or similar organizations.

Kandy Services Customer Proprietary Network Information (CPNI) and Traffic Data

This may include information regarding quantity, destination, technical configuration, location, amount of use and related billing information of telecommunications, interconnected or non-interconnected Voice over Internet Protocol (VoIP) services.  This may include but is not limited to the phone numbers that you call or send messages to (or the phone numbers that you receive these calls and messages from) through our Kandy services.  The date, time, location and duration of the calls or messaging may also be collected as well as other networking or device identifiers such as IP and SIP addressing sufficient to identify an individual end user.  This data is used for service delivery, billing, service level assurance and compliance with applicable regulatory obligations.

Ribbon provides Kandy services that are primarily for the benefit of organizations and subscribers in that the services transmit, route, switch or cache information.   These services often merely serve as conduits for data transmitted by third parties and subscribers.  Ribbon does not determine the purposes and means of processing of this personal information. 

Kandy Messaging, Voicemail, Video, Media and Image Files

Ribbon provides Kandy services that facilitate the upload, recording and storage of audio, video and images by way of services such as voicemail, call recording, transcription, conference and web collaboration recording.  Users may elect to store or record personal information including Sensitive Personal Information (SPI) within these resources at their discretion.

Kandy Anonymized, Non-Identifying Voice and Traffic Data

Ribbon may use anonymized, non-identifying data collected from use of our Kandy service.  This anonymized, non-identifying data may be used to enhance voice activation and recognition algorithms.  Similarly, Ribbon may use anonymized, non-identifying data collected from use of our Ribbon Protect products in order to improve traffic analysis algorithms and techniques.  This processing is executed under applicable terms and support Ribbon's legitimate interests in tuning, maintaining and enhancing these products and services.

uReach Customer Proprietary Network Information (CPNI) and Traffic Data

This may include information regarding quantity, destination, technical configuration, location, amount of use and related billing information of telecommunications, interconnected or non-interconnected Voice over Internet Protocol (VoIP) services.  This may include but is not limited to the phone numbers that you call or send messages to (or the phone numbers that you receive these calls and messages from) through our uReach services.  The date, time, location and duration of the calls or messaging may also be collected as well as other networking or device identifiers such as IP and SIP addressing sufficient to identify an individual end user.  This data is used for service delivery, billing,  service level assurance and compliance with applicable regulatory obligations.

Ribbon provides uReach services that are primarily for the benefit of subscribers in that the services transmit, route, switch or cache information.   These services often merely serve as conduits for data transmitted by subscribers.

uReach Messaging, Voicemail, Video, Media, Email and User Files

Ribbon provides uReach services that facilitate the upload, recording and storage of audio, video, images and other user files by way of services such as voicemail, virtual attendant, and transcription.  uReach also provides web-based email and cloud-based user storage with some services.  Users may elect to store or record personal information including Sensitive Personal Information (SPI) within these resources at their discretion.

RibbonCare Processing

Ribbon provides RibbonCare services to network operators which includes post-sales product technical issue resolution, installation and upgrade services.  This processing will often include sample data required to provide the above services including CPNI and traffic data (see above) as well as other information sufficient to identify an individual.

Credit Card Information

Ribbon only collects credit card information in order to bill for subscribed services or in support of entering a contract.  Ribbon utilizes credit card payment processing agents solely for the purpose of authenticating and securely processing payment for the services you receive.   We require these agents to take reasonable and appropriate measures to protect this information from loss or misuse.

For Vendors, Suppliers and Subcontractors

Ribbon may collect personal information about individuals who are employed by our suppliers and vendors.  This contact and payment information is strictly used to administer existing and future business arrangements as well as to establish appropriate and secure access to Ribbon's network where required.

For Website and Portal Visitors

Cookies

Ribbon websites and portals may use cookies to collect certain kinds of personal information about subscribers or users.  For more information on how Ribbon uses cookies and choices available to website visitors please refer to Ribbon's Cookie Policy and Ribbon's Cookie Preference Center accessible via the website.

Other Passive Site Tracking

Websites may also uses Internet Protocol (IP) addresses and log files to identify server problems. We Ribbon also uses web beacons to perform standard website traffic analysis in a manner similar to how we use cookies.  If in the future new types of passive tracking mechanisms are introduced, Ribbon will update this policy document accordingly.

Other Collection or Processing

Additional personal information may be collected, processed and disclosed for the purposes for which it was collected and for legal compliance purposes, including regulatory reporting, investigation of allegations of wrongdoing, and the management and defense of legal claims and actions, and compliance with subpoenas, court orders and other legal obligations.

Third Party Web Sites, Plugins or Widgets

Ribbon websites and services may include social network or other third party plugins and widgets. Accessing these links is done at your option.  Please review the sponsor's privacy policy provided at the respective site.

Cross-Border Personal Information Transfers

Where feasible Ribbon utilizes geographically aligned resources for primary data processing in order to reduce complexity and volume of cross-border personal information transfer.

Ribbon shall comply with the applicable laws governing international transfers of personal information and where required shall ensure that such transfers are made to countries where the data protection regime is compatible with that of the originating jurisdiction.

Transfers of Personal Information from the EEA, UK and Switzerland to Other Jurisdictions

Transfer Mechanisms

Ribbon employs the following transfer mechanisms for transfers of EEA and Swiss personal information in accordance with transfer restrictions imposed under the EU General Data Protection Regulation (GDPR) or the Swiss Federal Act on Data Protection (FADP).

  • GDPR Article 45 Adequacy decisions issued by the European Commission (EC) including the Privacy Shield Framework; and/or
  • Standard data protection clauses adopted by the EC under GDPR Article 46.

Similarly, the transfer of personal information pertaining to UK data subjects will only be transferred subject to the equivalent mechanisms as defined in the UK Data Protection Act (2018).

Transfer of Personal Information from the EU, UK and Switzerland to the United States under Privacy Shield

Ribbon Communications, Inc. and its U.S. subsidiaries Sonus Networks, Inc., GENBAND US LLC, and Ribbon Communications Federal Inc. ("Ribbon Privacy Shield Companies") comply with the EU-U.S. Privacy Shield and theSwiss-U.S. Privacy Shield Frameworks (Privacy Shield) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred to the U.S. from the European Union, the United Kingdom and Switzerland, respectively.   The Ribbon Privacy Shield Companies have certified to the Department of Commerce that they adhere to the Privacy Shield Principles.  If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.

To learn more about the Privacy Shield program, please visit http://www.privacyshield.gov.  To view the Ribbon Privacy Shield Companies' certification under Privacy Shield, please visit http://www.privacyshield.gov/list.

In addition to the protections provided under other sections of this Privacy Policy, the Ribbon Privacy Shield Companies and all EU, UK and Swiss Ribbon entities will provide the following protections for personal data transferred from the EU, UK or Switzerland to the U.S.

Choice

Individuals will be offered a clear, conspicuous, and readily available mechanism to choose (opt out) whether their personal information is (1) to be disclosed to a third party other than a third party acting as an agent to perform tasks on behalf of and under the instruction of Ribbon or (2) to be used for a purpose that is materially different than or incompatible with the purpose for which it was originally utilized or subsequently authorized by the individual.

Additionally, individuals will be offered a similar choice mechanism to give affirmative or explicit (opt in) choice whether their sensitive personal information is to be disclosed to a third party or used for a purpose other than the purposes for which it was originally collected or subsequently authorized by the individual by opt-in choice.  However, explicit (opt in) choice is not required when the disclosure of the sensitive personal information is (1) in the vital interests of the individual or another person; (2) necessary for the establishment of legal claims or defenses; (3) required to provide medical care or diagnosis; (4) necessary to carry out the organization's obligations in the field of employment law, or (5) related to personal information that is manifestly made public by the individual.

Transfer of Personal Data from the EU, UK or Switzerland to Processors in the United States

Ribbon's EU, UK and Swiss entities may transfer personal information to a processor in the United States solely for processing purposes.  A "processor" is a third party who processes personal information on behalf of and in accordance with the instructions of Ribbon's EU, UK and/or Swiss entities.  When personal information is transferred from the EU, UK and/or Switzerland to the United States solely for processing purposes, Ribbon's EU, UK and/or Swiss entities will comply with the applicable data protection laws including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018 and the Swiss Federal Act on Data Protection (FADP), respectively and enter into a contract with the processor to ensure that the processor (1) acts only on instructions of Ribbon's EU, UK and/or Swiss entities; (2) provides appropriate technical and organizational measures to protect the personal information against unlawful destruction or accidental loss, alteration, unauthorized disclosure or access; and understands whether onward transfers are allowed; and (3) assists Ribbon's EU, UK and/or Swiss entities in responding to individuals exercising their rights under the Privacy Shield principles, taking into account the nature of the processing.

Onward Transfers to Third Party Agents

After personal information is transferred from the EU, UK and/or Switzerland to the Ribbon Privacy Shield Companies in the United States, the Ribbon Privacy Shield Companies may thereafter transfer the personal information to third parties acting as controllers.  A "controller" is a person or organization which, alone or jointly with others, determines the purposes and means of the processing of personal information.  Examples of third party controllers may include banks and healthcare providers, or management personnel in other Ribbon Privacy Shield Companies offices outside of the U.S.  When the Ribbon Privacy Shield Companies makes such onward transfers to third party controllers, the Ribbon Privacy Shield Companies will comply with the Privacy Shield notice and choice principles and enter into a contract with the third party controller that provides that (1) such personal information may be processed only for limited and specified purposes consistent with the consent provided by the individual; (2) the third party controller will provide the same level of protections as the Privacy Shield principles; (3) the third party controller will notify the Ribbon Privacy Shield Companies if the third party can no longer meet its obligation to provide the same level of protection for the personal information as required by the Privacy Shield principles; and (4) upon such notice by the third party controller, the third party controller will cease processing the personal information and/or take reasonable and appropriate steps to remediate any unauthorized processing.

Verification

The Ribbon Privacy Shield Companies have verified and will verify annually through self-assessment that the attestations and assertions made about its Privacy Shield privacy practices are true and that those privacy practices have been implemented as represented and in accordance with the Privacy Shield principles.  This verification has been and will be signed by an officer of the Ribbon Privacy Shield Companies or other authorized representative of the Ribbon Privacy Shield Companies at least once a year and is available upon request by individuals or in the context of an investigation or a complaint about non-compliance.  The verification includes the following:

  • That the Privacy Policy is accurate, comprehensive, prominently displayed, completely implemented and accessible;
  • That the Policy conforms to the Privacy Shield Principles;
  • That individuals are informed of any in-house arrangements for handling complaints and of the independent mechanisms through which they may pursue complaints;
  • That it has in place procedures for training employees in the implementation of this Policy and disciplining them for failure to follow it;
  • That it has in place internal procedures for periodically conducting objective reviews of compliance with the above.

Recourse Mechanisms for Personal Data Transferred Under Privacy Shield

Inquiries or complaints regarding transfers of personal data from the EU, UK or Switzerland to the United States pursuant to Privacy Shield should be directed to:

Deputy General Counsel
5927 South Miami Blvd, Suite 150
Morrisville, NC 27560 USA
Email:  legal.privacy@rbbn.com
Fax:  (919) 457-9621

If a complaint remains unresolved, it will be resolved through alternative dispute resolution.  Ribbon has selected JAMS Mediation, Arbitration and ADR Services (JAMS) as the administrator of Ribbon's independent recourse mechanism for Privacy Shield disputes.  Ribbon has committed to refer such unresolved Privacy Shield complaints to JAMS in the United States.  You may find more information about dispute resolution and how to file a claim with JAMS at https://www.jamsadr.com/eu-us-privacy-shield.

Individuals have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding Privacy Shield compliance not resolved by any of the other Privacy Shield mechanisms.  Please visit Annex I for additional information: https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

Enforcement

The Ribbon Privacy Shield Companies are also subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

Liability

In the context of an onward transfer of personal information, the Ribbon Privacy Shield Companies have responsibility for the processing of personal information they receive under the Privacy Shield and subsequently transfers to a third party agent.  The Ribbon Privacy Shield Companies will remain liable under the Privacy Shield principles if their third party agent processes such personal information in a manner inconsistent with the Privacy Shield principles, unless the Ribbon Privacy Shield Companies proves that they are not responsible for the event giving rise to the damage.

Training

All employees who handle personal data transferred from the EU, UK or Switzerland to the U.S. will receive training regarding the data privacy principles and procedures under Privacy Shield Principles and this Policy.

Recipients and Disclosures

Within the Ribbon Group

In general, personal information may be shared within Ribbon in order to fulfill service commitments to our customers and in support of legitimate business interests.  These transfers are subject to the transfer mechanism controls described within the above section on Cross-Border Personal Information Transfers.

Ribbon restricts access to personal information to those employees, agents, or contractors who require access in order to carry out their assigned functions.

A list of Ribbon corporate locations is available here.  Processing locations will vary by service provided.

Third Party Suppliers

Ribbon uses vendors and partners for a variety of business purposes in order to help us fulfil the services we provide.  We share information with those vendors and partners when it is beneficial for them to perform work on our behalf.

Ribbon will only transfer or provide direct access to personal information covered by this policy to third parties which have:

  • made a commitment to respect the privacy rights of individuals;
  • limited processing of personal information to comply with customer's and/or data controller instructions; and
  • provided Ribbon contractual assurances that they will provide data protection no less stringent than is required by applicable privacy laws

Ribbon employs the following categories of third party suppliers in order to deliver the services shown below.

Kandy Services

Service Region

Third Party Category

Locations

EU

Colocation Services

EU, UK

Cloud Hosting Providers

EU

Value Added Voice & Messaging Services

EU, UK, US, Israel, Canada

NA

Colocation Services

United States, Canada

Cloud Hosting Providers

United States, Canada

Value Added Voice & Messaging Services

US, Israel, Canada

APAC

Colocation Services

Australia

Cloud Hosting Providers

Australia

Value Added Voice & Messaging Services

Australia, US, Israel, Canada

Global

CRM Technology Providers

United States

Global

Technology Service Partners

Turkey

 

RibbonCare Services

Service Region

Third Party Category

Locations

Global

Cloud Hosting Providers

United States

Global

CRM Technology Providers

United States

Global

Technology Service Partners

Turkey, India, Vietnam

 

uReach.com

Service Region

Third Party Category

Locations

NA

Colocation Services

United States

CRM Technology Providers

United States

Technology Service Partners

Turkey, India, Vietnam

 

Marketing

Service Region

Third Party Category

Locations

Global

CRM Providers

United States

Global

Web Hosting Providers

United States

 

Third Party Suppliers and EEA, UK and Swiss Personal Information

Additionally, for personal information pertaining to EEA or Swiss data subjects Ribbon will only transfer or provide direct access to personal information covered by this policy to third parties that:

  • are located in a jurisdiction subject to the EU GDPR or are subject to privacy laws designated to be adequate by the European Commission under GDPR Article 45; or
  • have committed to the Privacy Shield Principles as demonstrated by maintenance of certification within the Privacy Shield program; and/or
  • have provided Ribbon contractual assurances that transferred personal information will be subject to appropriate safeguards by way of standard data protection clauses adopted by the European Commission under GDPR Article 46. 

Similarly, the transfer of personal information pertaining to UK data subjects will only be transferred subject to the equivalent mechanisms as defined in the UK Data Protection Act (2018).  

Other External Disclosures

Ribbon may disclose information that individually identifies our customers, subscribers or identifies their devices in certain circumstances, such as:

  • to comply with valid legal process including subpoenas, court orders or search warrants, to defend or respond to legal actions, and as otherwise authorized by law, or in response to lawful requests by public authorities, including to meet national security or law enforcement requirements;
  • to prevent unauthorized, unlawful or abusive use of our products and services;
  • to determine credit risk or obtain payment for Ribbon services or products, such as through credit or collection agencies;
  • for other purposes with your consent.

If Ribbon enters into a merger, acquisition or sale of all or a portion of its assets or business, customer information will also be transferred as part of or in connection with the transaction as per local law and/or non-disclosure agreement.

Security and Integrity of Personal Information

To help protect the confidentiality of personal information, Ribbon employs appropriate information security safeguards.  These safeguards take into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks to individuals posed by any unauthorized disclosure of the information.

These safeguards include reasonable administrative, technical and physical measures to safeguard the confidentiality, integrity and availability of personal information against anticipated threats and unauthorized access to the personal information.

Ribbon conveys safeguard obligations to our third parties who receive personal information from or on behalf of Ribbon in the course of their relationship with our organization as described above in the Recipients and Disclosures section.

Ribbon employs reasonable means to keep personal information accurate, complete, and current, as needed for the purposes for which it was collected.

Retention of Data

Ribbon understands the data minimization and storage limitation principles within the GDPR and other data protection laws which require that data be deleted when its retention is no longer required to satisfy the purpose for which it was collected, generated or provided to Ribbon by a data controller.  Ribbon complies with all applicable information retention laws and regulations including those associated with electronic communication service provider requirements.

The following table illustrates some sample maximum retention periods employed by Ribbon.  

Information

Maximum Retention Period

Marketing Contact Data

24 months after last marketing service interaction

RibbonCare Tech Support Sample Data

24 months after case closure

 

Choices and Accommodation

The data Ribbon processes is described in further detail in the "Information We Collect and Use" section above.

Service Portals

If you have created a user profile on any Ribbon service portal (eg: Kandy, Salesforce or uReach.com), you may access and revise the personal information in your user profile when you log into your account. In general, these portals will only require minimal personal information that is necessary to provide and administer the service.

Marketing Materials

If you provide us with your email address or other contact information to enable us to provide current communications and information to you, we may use the information for providing such communications including delivery of press releases and other Ribbon marketing materials.  You may request to no longer receive Ribbon marketing communications by following the "unsubscribe" instructions in emails from Ribbon or by sending a request to the Contact identified below.

In the rare and unlikely event that Ribbon wishes to use an individual's personal information for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individuals, Ribbon will seek consent in advance as required by law.

Cookie Preferences

Ribbon websites may use cookies to collect certain kinds of personal information about subscribers or users.  For more information on how Ribbon uses cookies and choices available to website visitors please refer to Ribbon's Cookie Policy and Ribbon's Cookie Preference Center accessible via the website.

Kandy and uReach Services

Ribbon recognizes and promotes the right of subscribers to have reasonable opportunities to object to the collection (opt out), use and disclosure of their personal information while still maintaining the minimal data needed to provide the subscribed service.  Ribbon requires and collects CPNI, Traffic Data and billing information that is essential for providing the subscribed service.  Opting out or declining to provide the requested data may hinder the provision of subscribed services.  For further information on opting out please reference the instructions in the Contact section below.

Sensitive Information

Ribbon recognizes that for some sensitive information, affirmative express consent from individuals is required and must be obtained if such information is to be (i) disclosed to a third party or (ii) processed for a purpose other than those for which it was originally collected or subsequently authorized by the individuals through the exercise of opt-in choice.  In addition, Ribbon shall treat as sensitive any personal information received from a third party where the third party identifies and treats it as sensitive.

Data Subject Rights

Ribbon supports individual's data protection rights as provided for by applicable data protection law.

Service Portals

If you have created a user profile on any Ribbon service portal (eg: Kandy, Salesforce or uReach.com), you may access, examine, revise or delete the personal information in your user profile when you log into your account. In general, these portals will only require minimal personal information that is necessary to provide and administer the service.  Ribbon employs reasonable means to keep its individuals' personal information accurate, complete, and current.

EEA, UK and Swiss Data Subject Rights

Individuals having rights governed by EEA, UK or Swiss data protection law may exercise the following rights as data subjects.

Right

Summary

Notice

Ribbon provides required notice to individuals at points where Ribbon collects personal information.

Consent

Where consent is required for Ribbon to collect personal information, Ribbon will request the individual's consent.

Transparency

Access

Accuracy

Rectification

Individuals are provided with credentialized access to much of their own personal information that Ribbon collects and maintains through various service portals (please see Service Portals above).  This enables individuals to access, review, export, and in many instances enter or certify their personal information.

Erasure

(Right to be Forgotten)

Ribbon will review and act upon requests by individuals for the erasure of personal data to the extent required under applicable law.  Generally, individuals have the right to have their personal information erased when it is no longer necessary for the purposes for which it was collected or otherwise processed or the legal basis on which the data processing was based (e.g. consent) no longer applies.

Restriction of Processing

Ribbon will review and act upon requests to restrict processing of personal data of individuals to the extent required under applicable law. 

Objection to Processing

Ribbon will review and act upon requests by individuals to object to the processing of personal data to the extent required under applicable law.  Generally, an individual has the right to object to the processing of his or her personal data, and Ribbon should no longer process the data where it is unable to demonstrate compelling legitimate grounds for the processing. 

Receipt of information

(Right to Information)

Generally individuals have the right to receive information about their personal data which is processed by Ribbon.  Among others, this right to information includes information on the purposes of the processing, the categories of the processed data, the recipients to whom the personal data has been or will be disclosed and the intended storage period.  Upon request Ribbon will provide the requesting individual with a copy of his/her personal data processed by Ribbon.

Portability

Under certain conditions individuals have the right to receive their personal data which they have provided to the company in a structured, commonly used and machine-readable format. Individuals also have the right to transmit such data to another controller if the data processing is based on the consent of the individual and the data is processed by using automated processes.  In this regard, individuals should refer to their Access right described above.

 

In addition to the rights shown above, individuals have the right under GDPR Article 77 to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

California Privacy Rights

Ribbon does not disclose personal information to third parties for their own direct marketing purposes.

California law (Cal. Civ. Code §§ 1798.83) requires businesses to disclose to its California customers, upon request, the identity of any third parties to whom the business has disclosed personal information within the previous calendar year for the third parties' direct marketing purposes, along with the type of personal information disclosed.

If you are a California resident and would like to make such a request, email or contact as set forth in the section entitled "Requests" below. Requests must include "California Privacy Rights Request" in the first line of the description and include your name, street address, city, state, and ZIP code.  Please note that Ribbon is not required to respond to requests made by means other than through the provided e-mail address or mail address.

Any California residents under the age of eighteen (18) who are registered users of our online sites, services, or applications, and who have posted content or information on such sites, services, or applications, can request that such information be removed by sending an e-mail to the e-mail address set forth in the section entitled "Requests" below.  Requests must state that the user personally posted such content or information and detail where the content or information is posted.  Ribbon will make reasonable good faith efforts to remove the post from prospective public view.

Requests

If you are an individual who wishes to exercise the above rights, please email or contact us at:

Ribbon Legal Department
3605 East Plano Parkway - Suite 400
Plano, Texas 75074 USA
legal.privacy@rbbn.com

The ability of an individual to access, update or delete his or her personal information is not unlimited.  An individual's ability to access personal information may be limited, for example, where (a) the burden or expense of providing access would be unreasonable or disproportionate to the risks to the individual's privacy, (b) the information should not be disclosed or deleted due to legal reasons; or (c) providing access would compromise the privacy of another person.

Recourse, Complaints and Enforcement

Individuals who wish to file a complaint or who take issue with Ribbon's policy should direct such communications to Ribbon at:

Ribbon Legal Department
3605 East Plano Parkway - Suite 400
Plano, Texas 75074 USA
legal.privacy@rbbn.com

Ribbon undertakes annual compliance review of our policies, procedures with respect to data privacy to ensure that policy is implemented as presented and, in particular, to address any cases of non-compliance.  Ribbon also considers any impact to our policies and procedures as a result of privacy law changes or trends in recurring complaints from individuals.

Revision of Policy

Ribbon reserves the right to change this privacy policy at our discretion subject to business or legal requirements.  Please check this privacy policy from time to time and particularly before you provide personal information to Ribbon.  The effective date of the newest version of the privacy policy will be posted below, and in the event that we make material changes to this privacy policy, we will notify affected users by making a more prominent notice of the changes.

If we change our policy or use of personal information in such a manner that significantly diverges from the original purposes that we collected the information, we will provide notification as required by applicable law.  Your rights to object or obtain further information is as provided for in the Data Subject Rights and Recourse, Complaints and Enforcement sections.

Recent Revisions

Version

Date

Change Summary

1

October 2017

Significant updates to privacy policy to reflect GDPR preparations

2

March 2018

Inclusion of content to reflect Ribbon's EU-US Privacy Shield commitments

3

June 2018

Inclusion of "Anonymized, Non-Identifying Voice and Traffic Data" within Information We Collect

4

April 2019

Further modularization in order to accommodate layering

Preparations for UK Brexit

Additional uReach transparency for US/Canada subscribers

Additional transparency required under GDPR Article 13

 

Effective Date

April 8, 2019

Contact

If you have any comments or questions regarding this policy or Ribbon's privacy practices, please contact us at:

Ribbon Privacy
Suite 2100
500 Palladium Drive
Ottawa, Ontario, Canada K2V 1C2
privacy@rbbn.com