Privacy Policy

1. Welcome to Ketch!

Ketch Kloud, Inc. (“Ketch”, “we”, or “us”) is a software company that sells tools for companies to understand, implement, and manage their privacy obligations to their consumers and to control how they store and process data to make compliance with those obligations easy.

This Privacy Policy applies to your use of Ketch’s tools, services, and platform, including any associated Ketch mobile or desktop applications, ketch.com and other Ketch websites (collectively “the Services”, and any websites specifically, the “Websites”), as well as your relationship with Ketch.

‍By accessing or using the Services, you are agreeing to this Privacy Policy and concluding a legally binding agreement between yourself and Ketch.

If you do not agree with this Privacy Policy, please do not access or use the Services.

‍You should read our Privacy Policy in full to understand what data we collect, how we use it, and the circumstances where we may share it.

This Privacy Policy may change over time. If we make changes to it, we will post the modified Privacy Policy on our website here. We encourage you to visit this page periodically to learn of any updates.

2. What Information We Collect

We collect personal information (or personal data) and non-personal information (e.g., aggregated data or de-identified data) from you when you use our Services. As further described in this section, we may receive personal information about you that you submit through the Services or that is provided to us by a third party; we also may receive personal information about you automatically as you use the Services.

‍Information you Provide Us: We receive personal information about you that you choose to provide to us, including when you create an account; search for or purchase our offerings; configure settings; seek employment or business opportunities with us, communicate with us; or otherwise use our Services.

‍Information from our Customers: Our customers (“Customers”) may share information with us so that we can provide them with our Services. Each Customer chooses what information it shares, which may, for example, include personal information (“Customer Data”).

‍Usage and Log Data: When you interact with our Services, we may collect information from your device or web browser when you interact with the Services. For example, when you interact with the Services, we may log and store your IP address and technical information about your usage like your device ID, browser type, how you progressed through the Services, where you abandoned it, etc. We can use your IP address to determine your general location. This information is generally pseudonymous but is considered personal information in many places.

‍App Data: If you use a Ketch application, on mobile or other platforms, we may collect analytic information about your device, such as IP address, device ID, OS version, and clickstream. This information is also generally pseudonymous but is considered personal information in many places.

‍Information from Public Sources or Third Parties: We may receive additional information about you from public or third-party sources. For example, we may receive marketing, sales generation, and recruitment information from service providers or partners.

3. How We Use Your Personal Information

We collect, use, process, and store your personal information:

• To provide the Services.
• To personalize the Services.
• To receive and process job applications for jobs with us.
• To process data with machine learning algorithms, which helps us build, personalize, and improve the Services.
• With respect to Customer Data, in accordance with our contracts with our Customers.
• For internal business purposes, such as to improve our Services.
• To detect, investigate and prevent harmful, fraudulent, and illegal activity and security issues and protect the rights and property of Ketch and others.
• To enable communications through the Services.
  
• To contact you about additional Ketch services you might be interested in, unless you opt-out (see “How to Opt-Out of Email Communications”).
  
• As required by applicable law, legal process, or regulation.
  
• For purposes as disclosed at the time you provide your information, with your consent, and as further described in this Privacy Policy.
  

4. When We May Share Your Personal Information

We will only share your personal information with third parties under the following circumstances:

• With your consent.
  
• With our trusted agents and vendors that are contractually engaged to provide us with services, such as email management and cloud-based hosting. We provide a list of the services these companies provide for us below and update it regularly. These companies are obligated by contract to safeguard any personal information they receive from us and have agreed to only use the personal information for the specific purpose it was provided. The services include: a) cloud computer, data storage and file storage providers, b) email marketing providers, c) website and b2b analytics providers, d) customer relationship management, contact database vendors, data hygiene vendors, survey vendors and project management software providers, e) customer billing systems vendors, f) login authentication providers to ensure that the logins to our systems are working efficiently, g) auditing, debugging and security vendors.
  
• With respect to Customer Data, in accordance with our contracts with our Customers.
  
• With any of our affiliated companies, including a parent company, subsidiaries, joint ventures, or other companies under common control with us (in which case we will require such entities to honor this Privacy Policy).
  
• If we believe that disclosure is reasonably necessary to comply with a law, regulation, valid legal process (e.g., subpoenas or warrants served on us), or governmental or regulatory request to protect the security or integrity of the Services; and/or to protect the rights, property, or safety of Ketch, its employees, customers, users, or others. If we are going to release your data, we will do our best to provide you with notice in advance by email, unless we are prohibited by law from doing so.
  
• In the event we go through a business transition (such as a merger, acquisition by another company, bankruptcy, or sale of all or a portion of our assets, including, without limitation, during the course of any due diligence process), your personal information will likely be among the assets transferred. By providing your personal information, you agree that we can transfer such information in those circumstances without your further consent. Should such a business transition occur, we will make reasonable efforts to request that the new owner or combined entity (as applicable) follow this Privacy Policy with respect to your personal information. If your personal information would be used contrary to this privacy policy, we will request that you receive prior notice.
  

5. When We Use and Share Non-Personal Information

We use and share your non-personal information in a variety of ways, including to improve the Services.

6. Cookies and Tokens

We use tracking technologies, such as cookies, local storage, and pixel tags as described further below.

Cookies
Cookies may be set and accessed on your computer. Upon your first visit to the Services, a cookie will be sent to your computer that uniquely identifies your browser. "Cookies" are small files containing a string of characters that is sent to your computer's browser and stored on your device when you visit a website. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent; however, if you reject cookies, you may not be able to sign into the Services or take full advantage of our Services. Additionally, if you clear all cookies on your browser, you may need to reset any privacy settings in your browser which are stored in cookies.

Our Services use the following types of cookies for the purposes set out below:

You can also find more information about cookies and how they work, what cookies have been set on your computer or mobile device and how to manage and delete them at http://www.allaboutcookies.org and http://www.youronlinechoices.com.‍

7. How to Opt-Out of Email Communications

To stop receiving notifications or promotions, please click the unsubscribe link found at the bottom of each email. For purposes of this policy, we refer to data subjects located in the European Economic Area, United Kingdom, and Switzerland as “EEA” users. We only send marketing communications to users located in the EEA with your prior consent. Please see the section “GDPR: Information for EEA Users” below.

8. Storage, Security and How to Remove Your Information

We use industry standard technical, administrative, and physical controls to protect your data. While we take reasonable precautions against possible security breaches, no website or internet transmission is completely secure and we cannot guarantee that unauthorized access, hacking, data loss, or other breach will never occur. We will process and store your personal information only for the period necessary to achieve the purpose of the storage, or as permitted by law.  The criteria used to determine the period of storage of information is the respective statutory retention period. After expiration of that period, the corresponding information is routinely deleted, as long as it is no longer necessary for the fulfillment of a contract or the initiation of a contract.

9. De-Activating Your Account

You can choose to deactivate your account so that you are no longer viewable on the Services. You can request deactivation through the Services or by sending a message to privacy@ketch.com.

10. Third-Party Links

The Services may contain links to and from third-party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies, which may differ substantially from ours, and that we do not accept any responsibility or liability for their activities or the content of their privacy policies.

11. California Privacy Rights

Certain U.S. States (e.g., Connecticut, Colorado, California, Virginia, Utah) provide additional privacy protections for data subjects located within their jurisdictions, including: a) the right to see what data we have about you, your computer or device (i.e., the right to know), b) the right to delete the data we have about you, your computer or device (i.e., the right to delete), c) the right to correct data we have about you, your computer or device,  d) the right to opt-out of the sale or sharing of data about you, your computer or device to certain third parties (i.e., the right to opt-out from sales/sharing of your information), and e) the right to port such data to a different company. We do not discriminate against you if you exercise any of the above rights.

Please note that we may not be able to honor a right if doing so would otherwise violate applicable law. Applicable law in certain U.S. states (e.g., Colorado, Virginia) also provide you with the right to appeal to your attorney general’s office in the event that you disagree with how we honor the aforementioned rights.

Applicable law in certain U.S. states also provides you with the right to opt-out of the sale or sharing of your personal information, profiling and targeted ads. We do not transfer your personal information to third parties in exchange for money or engage in profiling or targeted ads, but we may share it with certain third parties for activities like targeted advertising, marketing, and analytics, and these may be deemed a "sale" under applicable law. You may opt-out of sale here if you are located in a place that requires such rights.
‍
‍Personal Information We Collect and Disclose for a Business Purpose.  Without limiting the description of the information we collect, we collect the categories of personal information about U.S. consumers identified in the chart below.

This information is required under California law, but we think it might be helpful to all readers of this policy as it provides a fair description of the types of information collected by Ketch in most places.

Categories of Sources
We collect the personal information identified as collected in the chart above from the following categories of sources:

• Consumers.
• Customers.
• Collected by our Services.
  
• Inferred by our Services; and
  
• Service providers.
  

Why We Collect, Use, and Share Information from Data Subjects in California
We use and disclose the personal information identified as collected in the chart above for our commercial and business purposes, as further described in this Privacy Policy.
These commercial and business purposes include, without limitation:

• Our commercial purposes, which include:
  
• To provide the Services.
  
• To personalize the Services.
  
• To receive and process job applications for jobs with us.
  
• To process data with machine learning algorithms, which helps us build, personalize, and improve the Services.
  
• With respect to Customer Data, in accordance with our contracts with our Customers.
  
• For internal business purposes, such as to improve our Services.
  
• To detect, investigate and prevent harmful, fraudulent, and illegal activity and security issues and protect the rights and property of Ketch and others.
  
• To enable communications through the Services.
  
• To contact you about additional Ketch services you might be interested in, unless you opt-out (see “How to Opt-Out of Email Communications”).
  
• Our business purposes as identified under applicable law, which include:
  
• Auditing related to our interactions with you.
  
• Legal compliance.
  
• Detecting and protecting against security incidents, fraud, and illegal activity.
  
• Debugging.
  
• Performing services (for us or our service providers) such as account servicing, processing orders, and payments, and analytics.
  
• Internal research for technological improvement.
  
• Internal operations.
  
• Activities to maintain and improve our services.
  
• Other one-time uses.
  

Recipients of Personal Information
We disclose, and have disclosed in the last 12 months, all of the categories of personal information identified as collected in the chart above to the categories of third parties listed below for business purposes:

• Cloud computer, data storage and file storage providers;
  
• Email marketing providers;
  
• Website and b2b analytics providers;
  
• Customer relationship management, contact database vendors, data hygiene vendors, survey vendors;
  
• Project management software providers;
  
• Customer billing systems vendors;
  
• Login authentication providers to ensure that the logins to our systems are working efficiently; and
  
• Auditing, debugging and security vendors.
  

Your California Rights Regarding Personal Information
‍Applicable law grants data subjects with certain rights with respect to the personal information collected by businesses. You may exercise the following rights regarding your personal information, subject to certain exceptions and limitations. For example, we tailor the rights made available to you based on applicable law in the place where our systems believe your computer or device is currently located:

• For certain categories of personal information, the right to request a list of what personal information (if any) we disclosed to third parties for their own direct marketing purposes in the preceding calendar year and the names and addresses of those third parties.
  
• The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you, the categories of sources from which we collected your personal information, our purposes for collecting or selling your personal information, the categories of your personal information that we have either sold or disclosed for a business purpose, and the categories of third parties with which we have shared personal information;
  
• The right to request that we delete the personal information we have collected from you or maintain about you.
  
• The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by applicable law.
  

To exercise any of the above rights, please contact us using the following information and submit the required verifying information, as further described below:

• Manage your privacy preferences here. (Note: we tailor your privacy preferences based on applicable law in the place where our systems believe your computer or device is currently located).
  
• By email at privacy@ketch.com.
  
• By phone at (888) 265-6736
  
• By mail at Ketch Kloud, Inc., Attn: Privacy, 23 Geary Street, Suite 600, San Francisco, CA 94108.
  

Verification Process and Required Information
We may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. For example, we may require you to provide, at a minimum, at least two data points that we determine to be reliable for the purpose of verifying your identity. We will then typically attempt to match the identifying information provided by you to the personal information already maintained by us to verify the request. If you have a password protected account on the Services, we may verify your identity through the existing authentication practices for your account, in which case we will require you to re-authenticate yourself before we disclose or delete your personal information.

Authorized Agent
You may designate an authorized agent to make a data subject request on your behalf by verifying your identity, as described above, and providing written permission for the authorized agent to act on your behalf.

Non-Discrimination
Ketch will not discriminate against a user because the user exercised any of the user’s rights described above or afforded to it under applicable data privacy law.

12. Nevada Privacy Rights

This section, which supplements the rest of this Privacy Policy, applies to residents of Nevada.

Under Nevada law, Nevada residents may submit a request directing us not to make certain disclosures of personal information we maintain about them.

To exercise this right, please contact us:

• By email at privacy@ketch.com.
  

13. International Data Transfers for EU, UK Swiss and Brazil Individuals

Personal data collected through our Services will be transferred to and stored by us in the United States; therefore, your personal data will be processed outside your jurisdiction in a country that is not currently subject to an adequacy decision by the European Commission, and that may not provide the same level of data protection as your jurisdiction, such as the EEA. We ensure that the recipient of your personal data offers an adequate level of protection and security, for instance by entering into the appropriate back-to-back agreements and, if required, standard contractual clauses or alternative mechanism for the transfer of data as approved by the European Commission (Art. 46 GDPR) or other applicable regulator.

Ketch complies with the EU-U.S. Data Privacy Framework program (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework program (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Ketch has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from theEuropean Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  Ketch has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework program Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. 

Pursuant to the Data Privacy Frameworks, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the Data Privacy Frameworks, should direct their query to privacy@ketch.com. If requested to remove data, we will respond within a reasonable timeframe. 

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@ketch.com.  

In the context of an onward transfer, Ketch is responsible for the processing of personal data it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Ketch shall remain liable under the DPF Principles if its agent processes such personal data in a manner inconsistent with the DPF Principles, unless the Ketch proves that it is not responsible for the event giving rise to the damage. 

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. 

In compliance with the Data Privacy Framework Principles, Ketch commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DataPrivacy Frameworks. European Union, United Kingdom, and Swiss individuals with DPF inquiries or complaints should first contact Ketch by email at privacy@ketch.com.  

Ketch has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.

If your  DPF complaint cannot be resolved through the abovechannels, under certain conditions, you may invoke binding arbitration for someresidual claims not resolved by other redress mechanisms.  See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2. 

The Federal Trade Commission has investigation and enforcement authority over our compliance with the DPF Principles. 

If you believe we have not respected your rights or otherwise not handled data correctly, then we encourage you to contact us directly and wewill do everything possible to help. 

However, where you still have a complaint, then you have theright to raise the matter with the Supervisory Authority (or data protection agency) in your country for resolution.

14. GDPR/LGPD: Information for EEA Users

This section applies to our European Economic Area (“EEA”) users. For purposes of this privacy policy, UK, Swiss and Brazil users are treated the same as EEA users.

Individuals located in the EEA have certain rights in respect of your personal data, including:

• The right of access to your personal data.
  
• The right to correct or rectify any inaccurate personal data.
  
• The right to restrict the processing of personal data
  
• The right to object to processing of personal data;
  
• The right to erase your personal data;
  
• The right to personal data portability; and
  The right to complain to a supervisory authority.
  

As a Ketch user:

• We rely on your consent as a lawful basis for processing personal data to provide you with marketing or promotional communications.
  
• We process personal data in order to provide you with Services as requested by you or to perform our contract with you as described in this document, including:
  
• To enable the Services to function as expected; and
  
• To communicate with you in response to customer service inquiries and to deliver non-promotional, service-related emails.
  
• Additionally, we process personal data based on our “legitimate interests” in providing you the Services including:
  
• To protect against fraud.
  
• Network and information security; and
  
• To offer the Services.
  

In some cases, Ketch may process personal data pursuant to a legal obligation or to protect your vital interests or those of another person.

Ketch will offer EEA, UK, Brazil and Swiss individuals whose personal data has been transferred to us the opportunity to choose whether the personal data we have received may be used or disclosed for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual. An individual may opt-out of such uses or disclosures of their personal data by contacting us at privacy@ketch.com.

15. Exercising Rights, Contacting Us and Accessing Your Information

Ketch users may exercise their rights regarding their personal information as follows:

• Manage your privacy preferences here. (Note: we tailor your privacy preferences based on applicable law in the place where our systems believe your computer or device is currently located).
  
• By email at privacy@ketch.com
  
• You may withdraw your consent to receive marketing or promotional communications at any time by clicking the “unsubscribe” link found within Ketch email updates and changing your contact preferences. Please note, you will continue to receive essential account-related information, even if you unsubscribe from promotional emails.
  

Matt George is Ketch’s worldwide data protection officer; and he may be contacted at dpo@ketch.com.

VeraSafe has been appointed as Ketch's representative in the European Union and in the United Kingdom for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union. If you are unable to reach Ketch as otherwise described in this section, VeraSafe can be contacted on matters related to the processing of personal data under GDPR. To make such an inquiry, please contact VeraSafe using this contact form or via telephone at +420 228 881 031 (Netherlands) or +44 (20) 4532 2003 (UK).

Alternatively, VeraSafe can be contacted at:
VeraSafe Netherlands BV,
Keizersgracht 555,
1017 DR Amsterdam,
Netherlands
‍
or

VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom

If you have any questions about our privacy practices, or if you wish to make a request, please contact us at either:
Ketch Kloud, Inc.
Attn: Privacy
23 Geary Street, Suite 600
San Francisco, CA 94108
or
privacy@ketch.com‍