Privacy Policy

Account and Profile Information

When you register for an account, we collect:

• Name, email address, and contact information
• Job title, department, and organization details
• Billing information and payment method details
• Profile preferences and settings
• User role and permissions
• Authentication credentials and security tokens

Service Usage Data

We automatically collect information about your use of our platform:

• Incident, problem, and change management records
• CMDB and asset management data
• Service catalog and request information
• Knowledge base and documentation access
• Performance metrics and analytics data
• IP address, browser type, and device information
• Access logs and authentication events
• User interaction patterns and feature usage

Customer Data

As an enterprise platform, we process customer data on behalf of our customers:

• IT service tickets and support requests
• Asset inventory and configuration data
• User directory and access management data
• Service level agreements and performance metrics
• Change management and approval workflows
• End-user personal data provided by customers

Communications Data

We collect communications data for service delivery:

• Email communications and support tickets
• Chat transcripts and support interactions
• Phone call recordings (where consented)
• Marketing communications preferences
• Newsletter subscriptions and engagement

Security Measures

We implement enterprise-grade security measures:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access control with multi-factor authentication
• Monitoring: 24/7 security monitoring and intrusion detection
• Compliance: Regular security audits and penetration testing
• Backup: Encrypted daily backups with geographic distribution
• Network Security: Firewalls, DDoS protection, and network segmentation
• Data Loss Prevention: Automated monitoring and prevention controls
• Employee Training: Regular security awareness and privacy training

Data Processing Agreements

For customers subject to GDPR or other data protection laws, we execute Data Processing Agreements (DPAs) that clearly define our responsibilities as a data processor. Our DPAs include:

• Scope and purpose of processing
• Security measures and obligations
• Subprocessor management procedures
• Data breach notification requirements
• Audit rights and cooperation
• Data subject rights assistance
• International transfer mechanisms
• Data deletion and return procedures

Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy, unless a longer retention period is required or permitted by law. Our retention periods include:

Breach Detection and Response

We maintain comprehensive breach detection and response procedures:

• 24/7 Monitoring: Continuous security monitoring and threat detection
• Rapid Assessment: Immediate breach assessment and classification
• Containment: Swift containment and remediation procedures
• Documentation: Detailed breach register and incident logs

Notification Requirements

Breach Notification Content

Our breach notifications include:

• Description of the breach and data categories affected
• Estimated number of affected individuals
• Likely consequences of the breach
• Measures taken to address the breach
• Recommendations for affected individuals
• Contact information for Data Protection Officer

European Residents (GDPR)

European residents have enhanced rights under the General Data Protection Regulation (GDPR), including rights to access, rectification, erasure, restriction of processing, data portability, and objection. Our GDPR compliance includes:

• Data Protection Impact Assessments for high-risk processing
• Record of Processing Activities (ROPA) maintenance
• Data Protection Officer appointment and contact
• EU-US Data Privacy Framework certification
• Standard Contractual Clauses for international transfers

California Residents (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, and opt-out of the sale of personal information. Our CCPA/CPRA compliance includes:

• "Do Not Sell or Share My Personal Information" opt-out
• Financial incentives disclosure
• Sensitive personal data restrictions
• Automated decision-making disclosures
• Contractual commitments to privacy rights

Brazilian Residents (LGPD)

Brazilian residents have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to access, correct, delete, and port their personal data. Our LGPD compliance includes:

• National Authority for Personal Data Protection (ANPD) compliance
• Data processing agent registration
• Security incident reporting to ANPD
• Impact assessments for high-risk processing
• Data protection officer designation

Canadian Residents (PIPEDA)

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including rights to access, correct, and withdraw consent for personal information. Our PIPEDA compliance includes:

• Privacy Commissioner of Canada compliance
• Meaningful consent collection
• Reasonable security safeguards
• Breach notification procedures
• Complaint handling and resolution

Healthcare Data (HIPAA)

For customers processing Protected Health Information (PHI), we provide HIPAA-compliant services including:

• Business Associate Agreements (BAAs)
• Minimum necessary standard implementation
• Administrative, physical, and technical safeguards
• Breach notification within 60 days
• HIPAA security training for staff

Compliance Program

We maintain a comprehensive privacy compliance program including:

• Regular privacy impact assessments
• Annual compliance audits and reviews
• Staff training and awareness programs
• Privacy by design and default principles
• Continuous monitoring and improvement

Compliance Standards

We align our practices with leading industry standards and frameworks:

• SOC 2 Type II: Security, availability, processing integrity, confidentiality, privacy
• ISO 27001: Information security management system
• EU-US DPF: Data Privacy Framework certification
• CSA STAR: Cloud security alliance certification
• PCI DSS: Payment card industry data security standard

Audit and Reporting

We maintain comprehensive audit and reporting capabilities:

• Real-time access logs and monitoring
• Data processing activity tracking
• Security incident logging and reporting
• Compliance dashboard and metrics
• Regular third-party security assessments