Data collections and uses
OVERVIEW
This Policy describes how we collect and use your Personal Information, whether it is shared and/or disclosed, and how we address privacy matters, such as deletion of your Personal Information upon request, and opting-out of marketing communications. Lastly, we describe methods for contacting us if you have privacy questions, comments or feedback.
Transparency is one of the best ways to earn your trust. The summary table explains what information we collect from you and why, based upon your relationship with us and as your relationship evolves with Pomerium.
| Description | What we collect | Why we collect it |
|---|
Visitors | Individuals who visit our public Websites, without logging into an account or using our products and/or services | IP Address, Cookie Information, Browser Info | To gauge interest in our products. To assess effectiveness of marketing efforts. To monitor usage patterns and improve our Websites, products and/or services |
Visitors (Marketing) | You may voluntarily share your information with us to receive information about our products and services, or to receive marketing information | Name, Email, Company Name | To share information about our products and/or services. For marketing purposes |
Users | Individuals who establish an account with us, or otherwise use our Websites, products and/or services | Name, Email, Username, Company Name, Credit Card details, Phone number | To access our products and Websites, products and/or services. Billing Security Identity verification 2-Factor Authentication |
Customer collaborators | Individuals who contribute to our public repositories | Name, Email, Username | To understand who contributes to our repositories. To track changes to our repositories |
Visitors
When you visit our Websites, we consider you a Visitor. As a Visitor, the information we collect from you is listed below. You’re not obligated to provide us with such Personal Information, and you are free to change or completely remove information shared with us; however refusing to provide requested Personal Information might prevent you from using certain features of the Websites.
What do we collect? | Why do we collect it? | Can you limit collection? |
|---|
Pomerium Cookies | To recognize you when you make a return visit and deliver overall a consistent experience | Most modern browsers allow you to delete or limit cookies |
Third-Party Tags and Cookies | To measure our marketing effectiveness | Most modern browsers allow you to delete or limit cookies, including third-party cookies; however, you may not be able to limit marketing tags entirely unless you do not visit our sites |
Internet Protocol (IP) Address | Part of the basic function of the internet. To measure who is visiting us and from where | The only way to avoid this is to not visit our sites |
Browser Metadata (i.e. browser type, version, operating system) | Part of the basic function of the internet. To ensure we maintain a positive website experience for most used browsers | Browsers communicate this automatically; however, some third-party extensions may allow you to limit this |
Marketing
In addition to the data above, you may also voluntarily share Personal Information with us, in order to receive information about products, or to register for an upcoming event.
What do we collect? | Why do we collect it? | Can you limit collection? |
|---|
Name + Email | To respond to your inquiry. Email you about product offerings, updated and other marketing promotions | No, these are required for us to contact you. You can opt out of marketing emails, see the Opt-Out section |
Company Name | To further develop our understanding of you | No, this is required |
Job Title | To further develop our understanding of you | Yes, this is voluntary |
Phone Number | To contact you | Yes, this is voluntary |
USERS
If you choose to register for an account with Pomerium or on our Websites, you will share Personal Information with us.
When you register, create a User Account on our Website and begin using our products, we consider you a User. This section describes our privacy practices related to Users. Keep in mind Users are also considered Visitors so we collect this data in addition to what was described for Visitors.
What do we collect? | Why do we collect it? | Can you limit collection? |
|---|
Email, Username and Password | In order to establish your account and allow you to securely access it. Email you about service updates, maintenance activities, security notifications, weekly summaries and other account related information | No, these are required for us to contact you. You can opt out of marketing emails, see the Opt-Out section |
Phone Number | For 2-factor authentication | This is required to enable 2-factor authentication |
Payment Data Credit card data Address | We require the minimum amount of data to process your payment | This is required to process your payment |
Our Products and Services
We use Personal Information to facilitate the business relationships we have with our Users, to comply with our financial regulatory and other legal obligations, and to pursue our legitimate interests where these are not overridden by the interests, rights or freedoms of Users . We also use Personal Information to complete payment transactions. We only collect and process your Personal Information to the extent it is necessary to fulfill these purposes and where we can rely on a legal basis for such processing
HOW LONG DO WE KEEP YOUR DATA?
We only process and keep any Personal Information for as long as necessary. to achieve the purpose for which the information was originally collected. The exact length of time we keep Personal Information depends on our processing purposes and the statutory retention period for that type of information. After the statutory period of time passes, or if storage of Personal Information is not needed, Personal Information is deleted or anonymized.
We use Personal Information we collect to provide products and/or services to you, keep our Websites running smoothly, and protect us legally. We will not use or share your Personal Information in ways unrelated to those described below. We do not use automatic decision-making or profiling, and will not sell your Personal Information for any purpose.
Customer’s instructions. Pomerium will only share and disclose Personal Information in accordance with a Customer’s instructions, including any applicable terms in the Customer Agreement, and in compliance with applicable law and legal process.
Customer access. Owners, administrators and other Customer representatives and personnel, as defined in the Customer Agreement, may be able to access, modify or restrict access to Personal Information.
Third party service providers and partners. We may engage third party companies or individuals as service providers or business partners to process Personal Information and support our business. Please email us at privacy@pomerium.com for a list of the third party service providers and/or partners we utilize.
During a change to Pomerium’s business.If Pomerium is involved in a merger, acquisition, sale of all or a portion of our assets, or bankruptcy, your Personal Information would be an asset transferred to or acquired by the successor entity or third party. You acknowledge that such transfers may occur and that the transferee may process Personal Information in a manner different to that set out in this Privacy Policy. You will be notified by email and/or a prominent notice on our Websites of any change in ownership or uses of your Personal Information, as well as any choices you may have regarding your Personal Information.
Aggregated or de-identified information. We may disclose or use aggregated or de-identified Personal Information for any purpose. For example, we may share aggregated or de-identified information with prospects or partners for business or research purposes, such as showing a total count of active users accessing our products.
To comply with laws. If we receive a request for information, we may disclose Personal Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation or legal process.
To enforce our rights, prevent fraud, and for safety. To protect and defend the rights, property or safety of Pomerium or third parties, including enforcing contracts or policies, or in connection with investigating and preventing fraud or security issues.
With consent. Pomerium may share Personal Information with third parties when we have consent to do so.
SECURITY
Pomerium takes appropriate administrative, technical, physical and organizational security measures to protect your Personal Information from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. We follow generally accepted standards to protect the Personal Information submitted to us, both during transmission and once it is received, taking into account the nature of such information and the risks involved in processing, and comply with applicable laws and regulations. While we have taken reasonable steps to secure the Personal Information you provide to us, please be aware that despite our best efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide Personal Information via our Websites.
If you have any questions about our security, or have reason to believe that your interaction with us is no longer secure, please contact us at security@pomerium.com.
POLICY FOR CHILDREN
We do not knowingly solicit information from or market to children under the age of thirteen (13). If you are under age 13, please do not give us any Personal Information. We encourage parents and legal guardians to monitor their children’s Internet usage and to help us enforce our Privacy Policy by instructing them to never share Personal Information through our Websites without their permission. If you suspect or become aware of any data we have collected from children under age 13, please contact us immediately using the contact information provided below.
NOTICE TO ALL NON-U.S. RESIDENTS
Our servers are located in the U.S.. If you are located outside of the U.S., please be aware that any information provided to us, including Personal Information, will be transferred from your country of origin to the U.S.. Pomerium transfers and processes data, including the data transfers under the EU-U.S. Privacy Shield, the Swiss-U.S. Privacy Shield, and the General Data Protection Regulation (GDPR), in accordance with applicable laws and regulations.
NOTICE FOR RESIDENTS OF THE EUROPEAN AND SWISS ECONOMIC AREAS
In order to comply with European Union and Swiss data protection laws, Pomerium, Inc. self-certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield. These frameworks were developed to enable companies to comply with data protection requirements when transferring Personal Information from the European Union and Switzerland to the United States. You can view our self-certification here.
Pomerium is responsible for the processing of Personal Information we receive, under Privacy Shield, and the subsequent transfers to a third-party acting as an agent on our behalf. With respect to Personal Information received or transferred pursuant to the Privacy Shield Framework, Pomerium is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, Pomerium may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
NOTICE FOR CALIFORNIA RESIDENTS
The California Consumer Privacy Act (CCPA) is a new data privacy law that applies to certain businesses which collect Personal Information from California residents. The law became effective on January 1, 2020. Pomerium already offers data protection terms pursuant to the GDPR in Europe. We are now also offering the same terms under the CCPA. Your rights under the CCPA are described below.
Please note that Pomerium does not rent or sell any Personal Information.
In addition, California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits California residents to request and obtain from us, once a year and free of charge, 1) information about categories of Personal Information (if any) we disclosed to third parties for direct marketing purposes, and, 2) the names and addresses of the third parties with which we shared Personal Information in the preceding calendar year.
If you are under 18 years of age, reside in California, and have a registered account with our Websites, you have the right to request removal of unwanted data that you publicly post on our Websites. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on our Websites, but please be aware that the data may not be completely or comprehensively removed from our systems.
If you are a California resident and would like to make a request, please submit your request in writing to us using the contact information provided below.
Your Rights
We recognize, under the EU-U.S. Privacy Shield, the Swiss-U.S. Privacy Shield, CCPA, and GDPR, that you have certain rights in regards to your Personal Information. We feel that your privacy and ability to preserve and exercise your rights is very important. You are encouraged to review and understand these rights as they pertain to you and your Personal Information. In certain circumstances, these rights include, but are not limited to:
Right to be Informed: This means we have to tell you why we process your Personal Information, our retention periods, and who it will be shared with.
Right of Access: This means we have to provide you with a copy of your Personal Information we process upon your request.
Right to Rectification: This allows you to have inaccurate Personal Information rectified, or completed if it is incomplete.
Right to Erasure: This allows you to have your Personal Information erased.
Right to Restrict Processing: This means you can limit the way we use their data.
Right to Data Portability: This allows you to receive a copy of your Personal Information in a structured, commonly used and machine-readable format and gives you the right to transmit those data to another controller without hindrance.
Right to Object: This allows you to object to the processing of your Personal Information at any time.
Right to Non-Discrimination: The CCPA prohibits covered businesses from discriminating against consumers for exercising their CCPA rights. This means we cannot charge a different price, deny access to our products, or impose penalties for exercising your rights under the CCPA.
Right to Withdraw Consent: This means you can withdraw your consent at any time.
In support of these rights, you may exercise any of the above rights, with respect to your Personal Information. You may update, correct or delete your Personal Information; if you wish to delete or suspend your account, please note that we may retain certain information as required by law or for legitimate business purposes. If you have become aware that an account has been created about you without your knowledge or consent, you may contact us to request deletion of that said account. You may contact us by emailing privacy@pomerium.com
For your protection, we may only respond with the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will respond to your request within 30 days.
CANDIDATES
We also provide the ability to submit job applications to our open job listings. To appropriately respond to your application, we need to collect and process your provided Personal Information, which may also be carried out electronically. If we begin an employment contract with you, your submitted application data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. We maintain your Personal Information for the period of time necessary to carry out our legitimate business interests and according to applicable laws. For information about specific retention periods, please contact us at privacy@pomerium.com
CHANGES TO THIS POLICY
If we make material changes to this Policy, we will revise the “Last Updated” date at the top of this Policy, and in some cases, we may provide you with more prominent notice (such as adding a statement to our homepage or sending you an email notification). Any changes or modifications will be effective immediately upon posting of the updated Privacy Policy, and you waive the right to receive specific notice of such changes or modifications.
We encourage you to review the Policy whenever you access the Websites to stay informed about our information practices and the ways you can help protect your privacy. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes to the Privacy Policy by your continued use of the Websites after the date such Policy is posted.
For any and all privacy-related matters, questions or comments, or to exercise a right under the GDPR, Privacy Shield, or the CCPA, you may contact us in writing or by email. Our contact information is as follow:
Pomerium, Inc.
℅ Security and Privacy Office
215 S. Highway 101, Suite 117 Solana Beach,
CA 92075 , United States
Email: privacy@pomerium.com
EU or Swiss residents with inquiries or complaints regarding this Privacy Policy should first contact Pomerium at privacy@pomerium.com. Please allow a reasonable amount of time to respond to your request. If you do not receive timely acknowledgement of your complaint, or if your complaint is not addressed by Pomerium, you may contact our U.S.-based alternative dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
If these processes do not result in a resolution, you may then contact your local data protection authority, the U.S. Department of Commerce, and/or the Federal Trade Commission for assistance. Under certain conditions, more fully described on the Privacy Shield website https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, you may invoke binding arbitration when other dispute resolution procedures have been exhausted and upon written notice to Pomerium at privacy@pomerium.com.
