Privacy Notice Effective Date: February 07, 2023 Demandbase, Inc. and its subsidiaries (collectively, “Demandbase”, “we”, “us” or “our”) respects the privacy of individuals. This Privacy Notice explains how we collect, use, disclose and protect personal information and how you can manage the personal information collected about you. This Privacy Notice applies to any website, virtual or physical event, or online service from, or other interaction with, Demandbase and its subsidiaries (Demandbase, Ltd., DemandMatrix LLC., DemandPrediction India Pvt Ltd., Engagio, Inc., InsideView Technologies, Inc. and Demandbase India Privacy Limited) and via the services we provide to our customers. As used in this Privacy Notice, “personal information” means information about an identified or identifiable natural person. Most of the sections in this Privacy Notice apply to everyone. There are sections below that only apply to certain individuals who are located in or residents of certain jurisdictions as described in those sections. Depending on the circumstances, Demandbase will use different legal bases to process personal information. For example, in some jurisdictions, when a user explicitly consents, then Demandbase may place cookies on the user’s machine. In other circumstances, Demandbase processes personal information when required to do so by law, or if necessary to protect your interests or the interests of a third party. Demandbase may also process data when it is in Demandbase’s legitimate interests, provided that such interests are not overridden by the fundamental rights and freedoms of individuals. A few examples of these legitimate interests may be to provide its services to customers, operate its business, conduct direct marketing and maintain security. This Privacy Notice does NOT apply to the websites or services offered by Demandbase’s customers, partners, publishers who display ads or to any other third parties. Personal Information We Collect from You You may provide your name, contact details, information about your job (like your title or the name of your employer), and other personal information directly to Demandbase when you interact with us or our services. We also may collect personal information about you through your device or browser while you are using or visiting our sites or services. This personal information may include your IP address, device identifier, geographic location, or usage information such as authentication, analytics, and other information that allows us to provide you with a more personalized experience. Please see the section on Cookies and Tracking below for more details. Personal Information We Receive from Other Sources In addition to personal information we collect from you, we may receive personal information about you from other sources and through our own research. We may receive your personal information from Demandbase customers or subscribers/users. We may also receive your personal information from third party partners, email campaigns and marketing partners. Such third party data may include company information, demographic information and personal information such as contact details. We collect personal information from a variety of publicly available and other sources, including company websites company blogs non-confidential corporate records or reports (for example, government filings and commercial registers) government publications press releases news articles magazines social media sites other content published by or on behalf of a company or published by data brokers or third parties. We license data, including personal information, from third parties who license, sell or provide the data they have collected, including data brokers. From these third parties we obtain many categories of personal information related to where and how individuals do business. We do not intentionally collect sensitive personal information like health information, biometric data or credit card information from third parties. We may also generate or receive predictive data or inferences about business users such as account characteristics, interests or business buying behavior. How We Use Personal Information Demandbase uses personal information in the following ways: For providing and improving our services. We use personal information to operate, improve and personalize our business and services. This use includes collecting data through integrations with customer relationship management (CRM), email or other systems, deriving insights, trends, use, and analytics, whether actual or predicted, from personal information collected and troubleshooting or improving our services. We may work with third parties to receive data or insights and combine that information with the data and insights provided by Demandbase. Advertising and marketing for Demandbase and our customers. We use personal information for advertising and marketing, such as analyzing and predicting business buying behavior or business interests and delivering interest-based advertising and content to your device, such as ads, widgets, or website content tailored to you on behalf of advertisers, across websites and devices, and over time. We use personal information to communicate with you about offers, events, services or products by us and partners. We may combine the personal information we have with third party data, including data that may directly or indirectly identify you, for improving the personalization of ads. As required by applicable law, legal process or regulation. We may use all personal information we collect or receive as required under law, legal or financial processes like audits. To provide reporting. We may use personal information to create reports (such as performance analytics, statistics, metrics and other details) for Demandbase customers on the companies that visit their websites as well as actual or predicted interests for those visitors. We may also use personal information to carry out actions requested by our customers, such as combining data with additional data in our possession or provided by customers or using data to retarget specific companies’ users with personalized advertising. For running our business. We use personal information for billing, account management, invoicing, investigating security and privacy incidents, as well as other legitimate business interests. Demandbase’s use of information received and transferred via Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements documented at: https://developers.google.com/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes. If your account on the Demandbase ABM Platform is managed by an administrator, that account administrator may have control with regards to how your account information is retained and deleted. Administrators are able to request the deactivation of an account made for you through your company. Cookies and Tracking Demandbase and our analytics/service providers use tracking pixels, web beacons and cookies to collect information. These technologies are used in analyzing trends, administering sites and services, tracking users’ online movements and to gather demographic information about our user base. Our sites and services may include social media features, such as the Facebook Like button and hosted apps that launch the social media sites. These features may collect your IP address and which page you are visiting on our site and may set a cookie in order to enable the feature to function properly. Your interactions with social media features are governed by the privacy policy of the company providing it. You can control the use of cookies at the individual browser level. Please note that disabling cookies may affect your ability to use certain parts of our website or services. For example, you may opt out of Google Analytics by visiting the Google Analytics opt-out page. We may use third party marketing cookies to help deliver ads relevant to your interests. These include: Facebook – you can learn more about Facebook cookies and how you can control them at https://www.facebook.com/policies/cookies/. Google/Youtube – You can learn more about Google cookies and how you can control them at https://policies.google.com/technologies/cookies. Hubspot – You can learn more about Hubspot cookies and how you can control them at https://legal.hubspot.com/cookie-policy. For more details, refer to the Demandbase Cookie Policy. Some browsers have incorporated “Do Not Track” (DNT) features. Demandbase does not respond to DNT signals. How We Share Personal Information We may share personal information with third parties as described below: Sharing with customers and partners. We share personal information with our customers and partners in order to provide services to our customers. Demandbase customers and other third parties may combine the personal information we share with additional data they have for their own marketing and sales purposes. Sharing to improve ad personalization. We share personal information to create targeting segments to enable organizations to better personalize advertising. Sharing for business purposes. We share personal information for our legitimate business needs. For example, we share information with third party vendors (such as marketing, billing or security service providers), consultants, and other service providers who work on our behalf and need access to personal information to perform their work for us. Sharing for security. We may share personal information for security, fraud prevention, law and policy enforcement purposes, or enforcing our policies and terms, protecting rights, property and safety of individuals or other third parties. Sharing for marketing. Any information you volunteer for marketing purposes or otherwise, may be shared with the other third party(ies) or partner(s) mentioned when you provide such information. Disclosures required by law. In certain situations, we may be requested or required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Demandbase will disclose personal information where required to do so. Transfer to acquirer or successor entity. If Demandbase sells a substantial portion of its assets or is acquired, reorganized, merged into another entity, goes out of business or enters bankruptcy, it is likely that personal information will be one of the business assets transferred in connection with such activity. Sharing with your consent. We may share your personal information for any other purpose with your consent. If you have consented to a specific use of your personal information, you may revoke your consent for future use of your personal information for that purpose by contacting us as described in the contact us section below. How We Protect Personal Information Demandbase takes reasonable and appropriate measures designed to protect and secure personal information and prevent its loss, misuse and unauthorized access, disclosure, alteration or destruction. Unfortunately, the transmission of information via the internet is not always secure. Although we do our best to protect information, we cannot guarantee the security of your personal information. Please review our Security Policy for additional details about how we protect personal information. Responsible Disclosure Policy If you suspect a vulnerability impacting Demandbase services or technology, please share such details confidentially with Demandbase at security@demandbase.com. Please provide exact details of the suspected vulnerability so that Demandbase can verify and reproduce your results. Please do not publish or share any details of the suspected vulnerability with third parties or online except with Demandbase’s permission once resolved. How Long We Keep Personal Information Demandbase retains personal information for as long as necessary to provide its products and services, comply with our legal obligations, resolve disputes and enforce our agreements. Where We Process Personal Information Demandbase is a global business and may transfer, store, or process your personal information in a country outside your jurisdiction, including the United States or any country in which Demandbase and its agents and service providers have personnel or facilities. The United States and other countries may not have data protection laws that are as comprehensive or protective as those in your country; however, our collection, storage and use of your personal information will at all times be in accordance with this Privacy Notice. When Demandbase transfers personal information from the European Economic Area (“EEA”), Switzerland or the United Kingdom (“UK”) to another country, we implement an appropriate data transfer mechanism, like entering into standard contractual clauses approved by European data protection regulators, or take other measures to provide an adequate level of protection under EEA, Swiss or UK law. Your Rights Everyone To exercise your privacy rights, please contact us. We will verify your identity when needed to comply with your request, which may include reviewing government identification, and may be unable to proceed with your request if we are not able to verify your identity. You have the right to request that we correct or otherwise amend your personal information. If you use Demandbase services, you may be able to correct your own personal information. If we have received your personal information from one of our customers, we may ask that you work with the customer to amend your personal information. We may ask for adequate proof of the amended personal information before we make a requested change. When serving interest-based advertising to you, Demandbase includes the Digital Advertising Alliance’s (“DAA”) AdChoices icon within such ads. This icon generally appears as in one of the corners of the ad and may be accompanied by text such as “AdChoices.” You can click on the icon to learn more about the ad and to opt-out of receiving ads from Demandbase in the future. Demandbase adheres to the DAA’s Self-Regulatory Principles for Online Behavioral Advertising. To learn more about the DAA and the AdChoices Icon, and to opt-out of interest-based advertising delivered by other participating companies, please visit the DAA webchoices page. The DAA opt-out requires the ability to set an opt-out cookie in your browser. Your opt-out choices only apply to the particular browser and device from which you have opted-out, and only to the applicable advertising channel. For example, you may still receive interest-based advertising in-app or email marketing if you opt-out via web browser cookies or otherwise not via cookies. Please note that if you delete, block or otherwise restrict cookies or change your cookie preferences, or if you use a different computer or Internet browser, you may need to renew your opt-out choice. Cookie-based opt-out preferences do not apply to Demandbase’s technology used to personalize web content to organizations. If we send direct marketing emails to you, we will rely on the legitimate interests basis of processing and include an “unsubscribe” link at the bottom of all of our emails to allow you to object to our use of your personal information for direct marketing. Click the link to unsubscribe and Demandbase will remove you from future emails within a reasonable amount of time. If you are a California resident If you are a California resident, you may exercise these rights or designate an authorized agent to exercise these rights on your behalf. Once per calendar year, you may request that we disclose to you what “Personal Information” as defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (referred to in a consolidated way as “CPRA”) we collect, use, disclose and sell, and the specific Personal Information we have collected about you in the prior 12 months. You have the right to request to know more details about the categories or specific pieces of Personal Information we collect (including how we use and disclose this Personal Information), to delete your Personal Information, to opt out of any “sales” (as defined in the CPRA) that may be occurring, and to not be discriminated against for exercising these rights. To exercise these rights please use this form or call 1-888-914-9661 and use Demandbase PIN 239540. Demandbase will not sell (as such term is defined in the CPRA) the Personal Information we collect under the CPRA without providing a right to opt out. Please note that we use cookies for advertising purposes as further described in our Cookie Policy. California Privacy Rights Metrics For the period between 08 February 2022 and 31 December 2022: Number of CA requests to know: Received: 9 Complied with in whole or in part: 7 Denied due to lack of verification: 2 Mean number of days within which we substantively responded: 5 Number of CA requests to delete: Received: 18 Complied with in whole or in part: 17 Denied due to lack of verification: 1 Mean number of days within which we substantively responded: 5 Number of CA requests to opt out of sale: Received: 12 Complied with in whole or in part: 11 Denied due to lack of verification: 1 Mean number of days within which we substantively responded: 5 If you are in Europe These rights apply if you are located in the EEA, Switzerland or the UK. If you are located in another country in Europe, please see the “Everyone” section above. Subject to the exemptions under law, you may have the right to request access or delete your personal information. Under certain circumstances, you have the right to receive personal information that we process about you and transmit that information to another organization, i.e., a right to data portability. You may also request that we restrict or block future processing of your personal information. Where we previously obtained your consent in order to process your personal information, you have the right to withdraw that consent. If you would like to exercise any of your rights, please contact us or send a written request to the address shown under contact us below. We will validate these requests and carry out valid requests. If the request is not deemed valid, then we will share the reasons why it is not valid and your options for seeking resolution through a supervisory authority and through judicial remedy. You have the right to lodge a complaint against us. To do so, contact the data protection authority in the country where you are located. Personal Information of Children Demandbase does not direct Demandbase sites or services to children under age 16. We do not knowingly collect information from children under 16. If you believe that we may have collected personal information from someone under 16 without required consent, please contact us at privacy@demandbase.com. Contact Us If you have any questions about our privacy practices or this Privacy Notice or would like to exercise your privacy rights, please contact us here. You may also write to us at: Demandbase, Inc. Attn: Privacy 680 Folsom Street Suite 400 San Francisco, CA 94107 USA privacy@demandbase.com If you raise a concern regarding your data, we will take reasonable steps to investigate and attempt to resolve any complaints or disputes. To contact our Data Protection Officer, please email dpo@demandbase.com. Demandbase has also appointed an EU Representative to act on our behalf and serve as a direct contact for supervisory authorities and individuals in the European Union. If you are in the EEA and would like to contact our EU Representative, please email: GDPRrepresentative@demandbase.com. Changes to this Notice When we change this Privacy Notice, the updated terms will be available on this page and effective as of the date posted. We encourage you to periodically review this page for the latest information on our privacy practices. Past versions of the policy will be archived and available here.
