Revised August 5, 2020
This Privacy Notice (the “Notice”) sets out how Rapiscan Systems, Inc. and our parent company and affiliates (including OSI Systems, Inc., Rapiscan Systems Limited, Rapiscan Systems Pte Ltd., Rapiscan Systems Electrical Trading LLC, Rapiscan Systems Government Services, Inc., Rapiscan Systems Laboratories, Inc. and American Science and Engineering)collects and processes information about you when you visit any website operated by that entity (“Website”) or when you otherwise provide your personal information to that entity, as described in this Notice.
The data controller for all personal information originating in the European Economic Area (“EEA”) or processed by data controller established in the EEA, collected through a Website is the OSI group entity that operates that Website, as indicated in the terms of use related to that Website, which also contains controller’s contact details. For products and services contracted offline, the data controller for all personal information originating in the European Economic Area (“EEA”) or processed by data controller located in the EEA, is the OSI group entity that contracts with you, as identified in the terms and conditions applicable to the purchase or use of the relevant product or service.
References in this Notice to “we”, “us” or “our” are references to the OSI group entity that is operating the relevant Website that you visit, contracting with you in offline sale of products and services, or to which you otherwise provide personal information as described in this Notice.
If you have any questions or concerns about our use of your personal information then please contact us using the contact details provided at the bottom of this Notice.
Quick links
We recommend that you read this Notice in full to ensure you are fully informed. However, if you only want to access a particular section of this Notice, then you can click on the relevant link below to jump to that section.
Information we collect and the sources of information
Your choices in relation to direct marketing
Legal basis for processing personal information (if EEA data protection law applies)
Links to Other Websites and social media
Your rights (if EEA data protection law applies)
EU-U.S. and Swiss-U.S. Privacy Shield
- Information We Collect and the Sources of Information
The personal information that we may collect about you broadly falls into the following categories:
Information that you provide voluntarily
Certain parts of our Websites may ask you to provide personal information voluntarily. Further examples of this are set out below; however as a general point, the personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.
- General: You may give us information, including information that can identify you (“personal information”), when you make enquiries about a Website, our products or services or about career opportunities with us or when you otherwise communicate with us (whether via a Website or otherwise). For example, we may ask you to provide specific information set out in an online inquiry form. You may choose to provide additional information to us when you communicate with us or otherwise interact with us, including in any free text box contained in an online inquiry form.
- Personal Information that we collect when you do business with us: We may process your personal information when you conduct business with us (whether through the Website or otherwise) as, or on behalf of, a customer or prospective customer, or as, or on behalf of, a vendor, supplier, consultant, professional adviser or other third party. In this context, we process:
- business contact information that is necessary to understand your role within your organization and to communicate with you;
- financial information that is necessary to take payment or fulfil contractual obligations or for related purposes;
- personal opinions/insights included in any feedback necessary to evaluate our performance and that of our suppliers or other business partners; and
- personal information necessary to conduct business effectively with you or the organization that you represent.
- Access to online resources: For access to certain resources on a Website (e.g. eLearning modules and Product Manuals) we may ask you to register as a customer/customer representative in order to create an online account. If so, as well as the business contact information referred to above, we will ask you to create a username and password.
- Providing feedback: Customers may also have the option of providing online feedback via a Website (e.g. in relation to OSI group company products, services or distributors) and we may request certain personal information via any online feedback form, such as name and contact details of the relevant customer representative. Customer representatives may choose to provide additional information in the context of such feedback, e.g. via free text boxes.
- Supplier change requests: Suppliers may make a change request via a Website. In such circumstances, we may request via the relevant online form personal information that is necessary to process such change request.
- Personal Information that you provide about another person: If you provide us with information about another person, for example, if you refer someone to us via the Website or as a company provide us with personal information of your employees, you confirm that you have provided them with this Notice for which their personal information will be processed and that you have obtained any necessary consents to the processing of their personal data. When we first contact them, we may tell them where we got the information from.
Information we collect automatically
When you visit our Websites, we may also collect certain information by automated means from your device. In some countries, including countries in the EEA, this information may be considered personal information under applicable data protection laws.
Specifically, the type of information we collect automatically may include information such as your IP address, device type, unique device identification numbers, browser type, broad geographic location (e.g. country or city-level location) and operating system, referring URLs, information about your visit including the URL clickstream to, through and from our Websites, download errors, number of Website visits, average time spent on the Website, length of visits to certain pages and page interaction. We collect this information automatically through the use of various technologies including through “cookies”.
A cookie is a data file containing small amounts of information that a website can send to your browser (and many websites do), which may then be stored on your computer as a tag that distinguishes your computer but does not name you. For further information about the types of cookies we use, why and how you can control cookies, please see our Cookies Notice at https://www.osi-systems.com/cookies. Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may refuse or delete cookies. If you refuse or delete cookies, some of our website functionality may be impaired. If you change computers, devices, or browsers, or use multiple computers, devices, or browsers, and delete your cookies, you may need to repeat this process for each computer, device, or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.
Personal Information for which we act as a data processor: We may process personal information on behalf of our customers in the context of supporting our products. We do so in accordance with the instructions of our customers. While our customers are in control of what personal information is processed by our products it will typically include personal information about individuals who are involved with the sale or support of our products. For further information about how such information is handled by our customers, please refer to the privacy policies of those customers.
- Use of personal information – purposes of processing
We process your personal information for the following purposes:
- To deal with your inquiries and requests;
- To create and administer records about any online account that you register with us, or to allow you to register an account with us;
- To maintain and improve the accuracy of the records that we hold about you;
- To provide you with information, and access to resources that you have requested from us;
- To provide our products and services;
- To otherwise maintain our relationship with you, including requesting/processing your feedback;
- Research and development and to improve our products and services (subject to your prior consent, which will be obtained separately from this Notice);
- Website and system administration and security;
- For internal analytics, in particular to better understand the visitors who come to our Websites, where they come from and what content on our Website is of interest to them and to improve the navigation and content of the Website (please see our Cookies Notice (https://www.osi-systems.com/cookies/) for information about the cookies that are used for this purpose);
- To assess financial, credit or insurance risks arising from any relationship or prospective relationship with a customer, supplier, distributor or other business partner;
- To alert you to updates to the Websites, and to any news and events in which we think you may be interested (should you opt in to receiving such updates) and/or to allow you to submit enquiries to us.
- Information we share
We will only disclose personal information to other companies within our group of companies (the OSI group entities, please see above) for the purposes outlined in this Notice, unless otherwise provided herein. We may also share your information with third parties when:
(1) It is necessary to involve third party service providers such as software product/support providers on a “need-to-know” basis in order to support the provision of our products and services and business operations;
(2) We have your consent or have otherwise been requested by you (e.g. with social media networks or with other employers);
(3) Required by a court order or any by any competent legal, regulatory, government agency, court or other third party where we believe disclosure is necessary: (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights or the rights of our customers, website users or other third parties (e.g. with debt collection and tracing agencies or to enforce our Terms of Use), or (iii) to protect your vital interests or those of any other person;
(4) In connection with the actual or potential sale or transfer of a business, provided that we inform the buyer (or potential buyer) it must use your personal information only for the purposes disclosed in this Notice and
(5) To credit reference agencies to establish creditworthiness, to the extent permitted by applicable law.
- Your choices in relation to direct marketing
Consistent with the consent you provide, we may use the information that you give to us to contact you by mail, telephone, fax email or electronic messaging service to alert you to updates to the Websites, and any news and events in which we think you may be interested (should you opt in to receiving such updates). We will also offer you the opportunity to unsubscribe in every communication sent.
- Legal basis for processing personal information (if EEA data protection law applies)
If EEA data protection law applies, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.
However, we will normally collect personal information from you only (i) where we need the personal information to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.
If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our Website(s) and to communicate with you as necessary to provide our services to you and for our legitimate commercial interest, for instance, when responding to your queries, improving our Website(s), undertaking marketing, or for the purposes of detecting or preventing illegal activities.
We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.
You can choose not to provide personal information to us, in particular where we rely on your consent for their processing. However, where the information that we request is necessary for the purposes of entering into and performing a contract with you or your organization and/or providing services/website facilities to you or your organization, failure to provide it will impede the contracting process and/or the provision of the relevant services or facilities.
- Links to Other Websites and social media
Websites may contain links to other websites which are outside our control and are not covered by this Notice. While we try to link only to websites that share our high standards and respect for privacy, we are not responsible for the content, security or privacy practices employed by other websites. If you access other websites using the links provided, the operators of these websites may collect information from you which will be used by them in accordance with their privacy notice, which may differ from ours.
On some Website pages, third parties that provide content, applications or plug-ins through our Websites may track your use of content, applications and plug-ins or customize content, applications and plug-ins for you. For example, when you share a webpage using a social media sharing button on our Websites (e.g., Facebook, Twitter, or Google Plus), the social network that has created the button will record that you have done this. For more information on social media plug-ins on our Websites, see our Cookies Notice.
- >Data Retention
We retain personal information that we collect from you where we have an ongoing legitimate business need to do so. If you are a client or vendor (or a representative of a client for vendor, your personal information will be retained for a period of time to allow us to provide or receive the relevant services (as the case may be) and to comply with applicable legal, tax or accounting requirements. We will not retain your information for longer than is necessary for our business purposes or for legal requirements.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible and we have legal obligation to do so (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
- Security
We maintain reasonable and appropriate technical and organizational security measures to protect the personal information you provide to us through a Website against unauthorized disclosure, use, alteration, or destruction. These measures are designed to provide a level of security appropriate to the risk of processing your personal information. Please note, however, that perfect security does not exist on the Internet. Therefore, while we endeavor to protect your personal information, when data is transferred over the Internet it may potentially be accessed and used by unauthorized parties.
Where you have a password, which enables you to access a Website, you are responsible for keeping this password secure and confidential.
- Your rights (if EEA data protection law applies)
If you are from certain territories (such as Switzerland or the EEA), you may have the right to access the personal information that we hold about you, or to correct, amend or delete such information pursuant to the General Data Protection Regulation (GDPR), EU-U.S. or Swiss-U.S. Privacy Shield Frameworks (as applicable). If EEA data protection law applies to the processing of your personal information, you have the following data protection rights, subject to conditions and exceptions provided in applicable EEA data protection law:
- If you wish to access (including requesting a copy of), correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the “Who to contact” heading below.
- In addition, you can object to processing of your personal information in certain circumstances, on grounds relating to your specific situation, ask us to restrict processing of your personal information or request portability (i.e., receive your personal data in a standardized format in case you wish to transfer it to another controller) of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “Who to contact” heading below.
- You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “Who to contact” heading below.
- Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
- You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.
- You have the right not to be subject to automated decisions (made solely by machines) affecting you, as defined by applicable EEA data protection law.
If you wish to make such a request, please contact us at the address below. Before responding to your request, we may ask you to verify your identity and to provide further details about your request. We will endeavor to respond within an appropriate timeframe and, in any event, within any timescales required by law or, where applicable, within the timescales required by applicable laws and regulations.
- International transfers
We belong to an international group of companies. Consequently, we may transfer your personal information outside your country of residence to countries or jurisdictions where we have facilities or engage third parties to provide services to us for the purposes outlined in this Notice. The countries to which we may transfer your personal information are in the following regions: USA, Europe, or Asia. Such countries may not have the same level of data protection as within your country. If we do make such a transfer, we will, take steps in accordance with applicable laws to protect your personal information. For example, as described below, we have certified (pursuant to Article 45 of the EU General Data Protection Regulation 2018) to the EU-U.S. and Swiss-U.S. Privacy Shield frameworks for international transfers of personal information from our group companies within the EEA and Switzerland to our group companies in the US. We have also implemented the EU Commission’s Standard Contractual Clauses (pursuant to Article 46.2 of the General Data Protection Regulation 2018) for international transfers of personal information from within the EU to U.S. legal entities, our service providers, and our non-US group companies located outside the EEA. Further details can be provided upon request using the contact details provided under the “Who to contact” heading below.
- EU-U.S. and Swiss-U.S. Privacy Shield
OSI Systems Inc. and its controlled U.S. subsidiaries (including American Science and Engineering, Inc., OSI Electronics, Inc., OSI Laser Diode, Inc., OSI Laserscan, Inc., OSI Optoelectronics, Inc., OSI Solutions, Inc., Rapiscan Government Services, Inc., Rapiscan Laboratories, Inc., Rapiscan Systems, Inc., S2 Global Inc., Spacelabs Healthcare Inc., (together “OSI US”) comply with the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the EEA or Switzerland to the United States. In doing so, OSI US has certified that, in respect of all personal information it receives from the EEA or Switzerland, it will adhere to the Privacy Shield Principles of: Notice, Choice, Accountability for Onward Transfers, Security, Data Integrity and Purpose Limitation, Access and Recourse, Enforcement and Liability. If there is any conflict between the terms in this Notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To access the Privacy Shield Program, and to find details of OSI US’s certification, please visit www.privacyshield.gov.
OSI US’s participation in the Privacy Shield applies to all personal information that is subject to this Notice and is received from the EEA or Switzerland. OSI US will comply with the Privacy Shield Principles in respect of such personal information.
Where OSI US transfers personal information from the EEA or Switzerland to its third party agents and service providers, it will require such third parties to process the information only for the purposes described this Notice and to provide the same level of protection for the information as required by the Privacy Shield Principles. OSI US remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the personal information on its behalf do so in a manner inconsistent with the Principles, unless OSI US proves that it is not responsible for the event giving rise to the damage.
If you believe that OSI US is processing your personal information within the scope of its Privacy Shield certification, you may direct any inquiries or complaints concerning its Privacy Shield compliance in the following ways:
(1) In the first instance, please send your inquiry or complaint to privacy@osi-systems.com or by writing to:
Rapiscan Systems, Inc.
Attention: Data Privacy Officer
Corporate Compliance Department
12525 Chadron Avenue
Hawthorne, California 90250
United States of America
OSI US will respond within 40 days.
(2) If you are not satisfied with OSI US’s response, or for complaints that cannot be resolved with OSI US directly, OSI US has chosen to cooperate with EU and Swiss data protection authorities (DPAs) and comply with the information and advice provided to it by an informal panel of DPAs in relation to such unresolved complaints EU DPAs are available here: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm. Swiss individuals may contact the Swiss Federal Data Protection and Information Commissioner’s (FDPIC) office. Under certain circumstances, you may be eligible to invoke binding arbitration.
(3) Further, the European and Swiss DPAs may refer your complaint to the US Department of Commerce or the Federal Trade Commission for further investigation.
OSI US’s commitments under the Privacy Shield are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.
[Update: August 2020] Last month, the European Commission invalidated aspects of the U.S.-EU Privacy Shield. We have carefully reviewed the applicable court ruling and have verified that our current policy, including the utilization of Standard Contractual Clauses, complies with applicable laws and regulations.
- For California Residents
We provide services and products primarily to business customers and generally only collect Personal Information of the employees of those business customers. In limited circumstances, when an individual consumer who is a California resident interacts with us directly, this section applies. Pursuant to the California Consumer Privacy Act of 2018, below is a summary of the Personal Information we collected from such California residents and the categories of third parties with whom we’ve shared consumer Personal Information. Information about the purposes of information collection and the sources of information are described in Sections 1-2, above.
|
Personal Information We Collect |
Categories of Third Parties to Whom We Have Disclosed Personal Information for a Business Purpose |
|
Identifiers and other information you provide, such as name, email address, physical address, telephone number, account number or name and password, and device identifiers (e.g., cookie IDs and IP address) |
|
|
Financial information and other customer records, including credit or debit card number, credit related information, bank account number, or any other financial information |
|
|
Protected class and demographic information, such as age, race, gender, education, or date of birth |
|
|
Internet or other electronic network activity information, such as your browsing history, search history, and information regarding your interactions with and use of the Website |
|
|
Commercial information, such as products or services purchased, obtained, or considered, or other purchase or subscription information or consumer histories or tendencies |
|
|
Audio, video, or other sensory information, such as call recordings or video surveillance of our premises |
|
|
Professional or employment-related information of business contacts, such as job title, organization, professional licenses, credentials, specialty, professional affiliations, or other professional information |
|
|
Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences |
|
California residents who interact with us outside of business-to-business transactions may have certain rights under the CCPA, subject to legal limitations, regarding the collection, use, and sharing of personal information. California residents may exercise the following rights regarding personal information collected via by contacting us via our Online Request Form or by calling us toll-free at 1-833-308-1010.
Right to Know. You have the right to request information about the categories of personal information we have collected about you in the prior 12 months including the categories of sources from which we collected the personal information, the purposes for collecting the personal information, and the categories of third parties with whom we shared your personal information, (“Categories Report”). You may also request information about the specific pieces of personal information we have collected about you in the prior 12 months (“Specific Pieces Report”). You may also specifically request information about any third parties with whom we have shared your personal information for those third parties’ direct marketing purposes in the preceding calendar year. You may request this information using the contact information above.
Right to Delete. You have the right to request that we delete personal information that we have collected from you.
Right to Opt-Out. We do not sell personal information.
In accordance with applicable law, we will not discriminate against you for exercising these rights.
Verification. In order to process requests, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. If you are submitting a request on behalf of a household, we will need to verify each member of the household in the manner set forth here. For a Right to Know Specific Pieces Report, we will request applicable documentation to verify your identify in addition to a signed declaration, under penalty of perjury, to verify your identity. For a Right to Know Categories Report, we will request a government issued form of identification to verify your identity. For a Right to Delete request, we will request that you confirm your identity by confirming a “challenge” question, or by verifying that you own the email address or phone number originally provided to us.
Authorized Agents. You may use an authorized agent to exercise your rights on your behalf. If you are making any of the requests above through an authorized agent, we will request signed authorization from you and will seek to verify you as described above or we will accept a legal Power of Attorney under the California Probate Code to the authorized agent. If you are an authorized agent, use the Online Request Form. You may be required to separately upload documentation demonstrating you have authority to exercise rights on the consumer’s behalf.
Timing. We will respond to Requests to Delete and Requests to Know within 45 days, unless we need more time in which case we will notify you and may take up to 90 days total to respond to your request.
- Updates to this Notice
From time to time we may update this Notice in response to changing legal, technical or business developments. If material changes are made to this Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make (for example we may notify you with a notice on our Websites for a period of 30 days).
You can see when this Notice was last updated by checking the “last updated” date displayed at the top of this Notice.
- Who to contact
If you have any questions or comments in relation to this Notice, or our privacy practices or use of your personal information, please contact us via email at privacy@osi-systems.com or write to:
OSI Systems, Inc.
Attention: Data Privacy Officer
Corporate Compliance Department
12525 Chadron Avenue
Hawthorne, California 90250
United States of America
- or -
Rapiscan Systems, Inc.
Attention: Data Privacy Officer / Compliance Department
12525 Chadron Avenue
Hawthorne, California 90250
United States of America