MASTERCONTROL PRIVACY NOTICE

1. WHO WE ARE

MasterControl is a global company headquartered in the US, with offices in Utah, United Kingdom, Japan and Australia. We provide a full line of industry specific quality and compliance software solutions and services (the "Services") to customers worldwide. Our offerings enable regulated companies to accelerate compliance and get to market faster while reducing costs and improving efficiency.

2. WHAT PERSONAL DATA DO WE COLLECT?

The information we collect depends on the context of your interactions with MasterControl and the choices you make (including your privacy settings), the products and features you use, your location and applicable law.

2.1. Information you provide to us

• Our Website offers various ways to contact us, such as through form submissions, email, or phone to inquire about our company and Services. For example, when expressing an interest in obtaining information about MasterControl or our Services, subscribing to marketing or otherwise contacting us, we will collect personal information from you (such as business contact information you provide to us). We may also collect information from you in person at a tradeshow or event or via a phone call with one of our sales representatives.
• You or your organizations administrator may provide certain personal information to us through the Services. For example, when you create a MasterControl account to access and use the Services, when you consult with customer support, and/or send us an email or communicate with us in connection with the Services (for example, to make a support request).

The personal information we collect may include:

• Business contact information (such as your name, job title, organization, phone number, email address and country) as well as the nature of your communication;
• Professional information (such as your company name, company size, department, industry, job title, company address, and company telephone number);
• Marketing information (such as your contact preferences); and
• Any information you choose to provide to us when completing any 'free text' boxes in our forms.
• Account log-in credentials (such as your email or username and password, when you sign-up for an account with us).
• Troubleshooting and support data (which is data you provide when you contact MasterControl for help, such as the solution you use, and other details that help us provide support. For example, contact or authentication data, the content of your chats and other communications with MasterControl, and the solution you use related to your help inquiry).
• Payment information (including your credit card numbers and associated identifiers, billing address and background information, but only where you pay for the Services).

If you ever communicate directly with us, we will maintain a record of those communications and responses.

2.2. Information we collect automatically

• We use common information-gathering tools, such as tools for collecting usage data, cookies, web beacons and similar technologies to automatically collect information that may contain personal data from your computer or mobile device as you navigate our Websites, certain Services or interact with emails we have sent to you. For further information about our use of cookies and similar tracking technologies, please review our Cookie Notice.
• Websites and email communications: When you visit our Website or interact with our emails, we use cookies and similar technologies such as web beacons, tags and JavaScript, alone or in conjunction with cookies, to automatically collect certain technical information from your browser or device (such as your IP address, your operating system, your browser, device information, unique device identifiers, mobile network information, request information (speed, frequency) and information about how you interact with our emails, Website and other websites (such as the pages and files viewed, searches, operating system and system configuration information and date/time stamps associated with your usage). This information is used to analyze overall trends, to help us provide and improve our Websites and to guarantee their security and continued proper functioning. For further information about our use of cookies and similar tracking technologies, please review our Cookie Notice.
• Device and usage Data: In connection with your organization's deployment of certain MasterControl Products and Services, we may also automatically collect certain data through log files and other technologies relating to the performance and configuration of the Products and Services, and our customer's and their end-user's consumption of and interaction and use of such Services (for example, we may know who the most active end users are, which pages of the Services are visited and which links are clicked or features are used). This information may include IP address (or proxy server), device and application identification numbers, location, browser type, Internet service provider and/or mobile carrier, the pages and files viewed, searches and other actions you take, operating system and system configuration information and date/time stamps associated with your usage.
  This information is used to maintain the security of the Services, to provide necessary functionality, as well as to improve performance of the Services, to assess and improve customer and end user experience of the Services, to review compliance with applicable usage terms, to identify future opportunities for development of the Services, to assess capacity requirements, to identify customer opportunities and for the security of MasterControl generally (in addition to the security of our Services). Some of the device and usage data collected within the Services, whether alone or in conjunction with other data, could be personally identifying to you. Please note that this device and usage data is primarily used for the purposes of identifying the uniqueness of each end user logging on (as opposed to specific individuals), apart from where it is strictly required to identify an individual for security purposes or as required as part of our provision of the Services to our customers (where we act as a processor).

2.3. Information we collect from other sources

• In order to enhance our ability to provide relevant marketing, offers and services to you and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, data providers, social media platforms, as well as from other third parties. This information may include mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), IP addresses, social media profiles, social media URLs and custom profiles, for purposes of targeted advertising, event promotion and optimizing our Website, Services and marketing activities.

2.4. Social Media Features

• Our Websites may use social media features, such as the Facebook “like” button, the “Tweet” button and other sharing widgets (“Social Media Features”). You may be given the option by such Social Media Features to post information about your activities on a website to a profile page of yours that is provided by a third-party social media network in order to share with others within your network. Social Media Features are either hosted by the respective social media network or hosted directly on our website. To the extent the Social Media Features are hosted by the respective social media networks and you click through to these from our website, the latter may receive information showing that you have visited our website. If you are logged in to your social media account, it is possible that the respective social media network can link your visit to our websites with your social media profile.
• MasterControl also allows you to log in to certain of our Websites or Services using sign-in services such as Facebook Connect. These services will authenticate your identity and provide you the option to share certain personal information from these services with us such as your name and email address to pre-populate our sign-up form.
• Your interactions with Social Media Features are governed by the privacy policies of the companies providing the relevant Social Media Features.

3. HOW DO WE USE YOUR INFORMATION?

We use and process the personal information we collect and/or receive (alone or in combination) for the purposes and legal bases identified below:

• Providing our Websites and Services: We process your personal information in reliance on our legitimate interest to operate and administer our Websites and to provide you with the Services and content you access and request (e.g., to download content from our Websites).
• Communicating with you about our Products and Services: We may send you product, service, technical and other administrative or technical email, messages and other types of notifications in reliance on our legitimate interests in administering the Products and Services and to provide certain features. These communications are considered part of the Services and in most cases you cannot opt-out of them. If an opt-out is available, you will find that option within the communication itself or in your account settings.
• Promoting the security of our Websites and Services: We process your personal information by tracking use of our Websites and Services, creating aggregated, non-personal data, verifying accounts and activity, investigating suspicious activity and enforcing our terms and policies, to the extent this is necessary for our legitimate interest in promoting the safety and security of the Services, systems and applications and in protecting our rights and the rights of others.
  • For the UK, French, and German websites, EU visitors have the option to control the amount of processing through acceptance or denial of certain cookies.
• Providing necessary functionality: We process your personal information in reliance on our legitimate interest to provide you with the necessary functionality required during your use of our Websites and Services.
• Handling contact and support requests: If you complete a contact form, request additional support or documentation, request end user support, or if you contact us by other means including via a phone call, we process your personal information to perform our contract with you and to the extent it is necessary for our legitimate interest in fulfilling your requests and communicating with you.
• Managing event registrations and attendance: We process your personal information to plan and host events, training, or webinars for which you have registered or that you attend, including sending related communications to you, to perform of our contract with you.
• Developing and improving our Websites and Services: We process your personal information to analyze trends and to track your usage of and interactions with our Websites and Services to the extent it is necessary for our legitimate interest in developing and improving our Websites and Services and providing our end users with more relevant content and service offerings, or where we seek your valid consent.
• Assessing and improving end user experience: We process device and usage data as described in sections above, which in some cases may be associated with your personal information, in order to analyze trends in order to assess and improve the overall user experience to the extent it is necessary for our legitimate interest in developing and improving the service offering, or where we seek your valid consent.
• Reviewing compliance with applicable usage terms: We process your personal information to review compliance with the applicable usage terms in our customer’s contract to the extent that it is in our legitimate interest to ensure adherence to the relevant terms.
• Assessing capacity requirements: We process your personal information to assess the capacity requirements of our Services to the extent that it is in our legitimate interest to ensure that we are meeting the necessary capacity requirements of our service offerings.
• Identifying customer opportunities: We process your personal information to assess new potential customer opportunities to the extent that it is in our legitimate interest to ensure that we are meeting the demands of our customers and their end users’ experiences.
• Registering office visitors: We process your personal information for security reasons, to register visitors to our offices and to manage non-disclosure agreements that visitors may be required to sign, to the extent such processing is necessary for our legitimate interest in protecting our offices and our confidential information against unauthorized access.
• Displaying personalized advertisements and content: We process your personal information to conduct marketing research, advertise to you, provide personalized information about us on and off our Websites and to provide other personalized content based upon your activities and interests to the extent it is necessary for our legitimate interest in advertising our Websites, Services or, where necessary, to the extent you have provided your prior consent.
  • EEA and California Residents: Please see the Geographical Privacy Right Supplements section below to learn how you can control how the processing of your personal information for personalized advertising purposes.
• Sending marketing communications: We will process your personal information to send you marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, telemarketing calls, SMS, push notifications, etc.) about us and our affiliates and partners, including information about our products, services, promotions or events as necessary for our legitimate interest in conducting direct marketing or to the extent you have provided your prior consent.
  • EEA and California Residents: Please see the Geographical Privacy Right Supplements section below to learn how you can control how the processing of your personal information by MasterControl for marketing purposes.
• Complying with legal obligations: We process your personal information when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws to the extent this requires the processing or disclosure of personal information to protect our rights or is necessary for our legitimate interest in protecting against misuse or abuse of our Websites, Services, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes or to respond to lawful requests.

3.1. How Do We Share Your Information?

We may disclose your personal information to the following categories of recipients. MasterControl does not sell any personal information.

• Service providers. In order to provide our Website and Services to you, it is necessary for us to disclose your information to contracted third parties and service provider partners who perform certain functions of our service on our behalf. Examples include payment providers (to authorize, record, settle and clear payment card transactions); cloud hosting providers (to provide data storage and processing services); communications providers (to process new queries and to manage our emails); and analytics company to perform analysis on the Website and Services.
• MasterControl's affiliates. MasterControl is headquartered in Salt Lake City and has offices in the United Kingdom, Japan and Australia. We may share information with our parent companies, subsidiaries and/or affiliates for use and processing purposes described in this Notice.
• Compliance with laws. We may disclose information where we are legally required to do so in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or other legal process (including in response to public authorities to meet national security or law enforcement requirements).
• Vital interests and legal rights. We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our signed agreements or this Notice, or as evidence in litigation in which MasterControl may be involved.
• Business transfers. We may share or transfer information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, provided that we inform the buyer it must use your personal information only for the purposes disclosed in this Notice.
• Social Media Widgets. The Website may include links that direct you to other websites or services whose privacy practices may differ from ours. Your use of and any information you submit to any of those third-party sites is governed by their privacy policies, not this one.
• Consent. We may share your information with any other person with your consent to the disclosure.

3.2. Cross-Border Data Transfers

MasterControl is headquartered in the United States and has offices, employees and services providers who operate around the globe. Therefore, as a global business, MasterControl processes, hosts and transfers personal information in different countries, including in the United States. These countries may have data protection laws that are different to the laws of your country.

MasterControl fully assesses the circumstances involving all cross-border data transfers and has suitable safeguards in place to require that your personal information will remain protected in accordance with this Notice. These include implementing the European Commission's Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA in accordance with European Union data protection law.

We process any personal data of our customers pursuant to the obligations of the Standard Contractual Clauses, which form part of our Data Processing Agreement (DPA). For reference, a copy of our DPA can be downloaded here.

4. SECURITY MEASURES IMPLEMENTED BY MASTERCONTROL

We are committed to security and privacy, maintaining appropriate physical, technical and administrative standards to protect the personal information that we collect.

The personal information collected or obtained by MasterControl is stored in secure operating environments that are not available to the public. However, no data transmission over the internet can be guaranteed to be 100 percent secure. As a result, while we strive to protect your personal information, we cannot warrant the security of any information you transmit to us or from our website and services.

5. GEOGRAPHICAL PRIVACY RIGHT SUPPLEMENTS

European Economic Area and UK Supplement

If you are a resident of the European Economic Area (Member States of the European Union, Iceland, Liechtenstein and Norway) or of the United Kingdom, the following additional rights apply to you:

• You can access, correct, update, delete, and deactivate your personal information through the Website by signing in to your customer account and editing your information as desired. You can also contact us at [email protected] for assistance.
• You can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. To exercise these rights, contact us at [email protected].
• You can opt out of receiving marketing emails from us by clicking the “unsubscribe” link in the email. If you choose to no longer receive marketing information, we may still communicate with you regarding such things as your security updates, critical information about the product or Services functionality, responses to service requests, or other transactional, non-marketing purposes.
• If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. To exercise this right, contact us at [email protected].
• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

California Supplement

If you are a resident of California, the following additional rights apply to you:

• You have the right to request the categories of personal information we have collected about you and/or disclosed for a business purpose. These categories are provided above in section 2 for quick reference. For a list of the specific categories of information we have collected about you or disclosed for a business purpose, please contact the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to request the categories of sources from which your personal information is collected. These categories are listed above in section 2 for quick reference. For a list of the source categories specific to you, please contact the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to request the business or commercial purpose of collecting your personal information. Our purposes for collection are listed above in section 3 for quick reference. For a list of the business or commercial purposes we have collected your specific data for, please contact the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to request the categories of third parties with whom we share personal information. These categories are listed above in section 3.1 for quick reference. For a list of the third-party categories specific to your data, please contact the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to request the specific pieces of personal information we have collected about you. For a list of your specific pieces of personal information that we have collected, please contact the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to opt out of your personal information being sold. MasterControl does not sell any of your personal information, so opting-out is not necessary.
• You have the right to request the deletion of your personal information which has been collected over the past 12 months. Pursuant to the California Consumers Protection Act, deletion of personal information is dependent on the ability to verify your (the requestor’s) identity, and an evaluation by MasterControl to determination if the personal information is necessary to be maintained in order to:
  • Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer (you), or reasonably anticipated within the context of a MasterControl’s ongoing business relationship with the consumer (you), or otherwise perform a contract between MasterControl and the consumer (you).
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
  • Debug to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer (you) has provided informed consent.
  • To enable solely internal uses that are reasonably aligned with the expectations of the consumer (you) based on the consumer’s (your) relationship with MasterControl.
  • Comply with a legal obligation.
  • Otherwise use the consumer’s (your) personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.
  
  You may request identity verification and a deletion evaluation by contacting the Quality Department at [email protected] or toll-free at 1-800-825-9117.
• You have the right to not be discriminated against for exercising any of the applicable rights described above. Examples of discrimination include denying you goods or services, charging you different prices or rates for goods or services, and providing a different level or quality of goods or services to you.

5.1. How Long Do We Keep Your Personal Information?

We retain your personal information where we have an ongoing legitimate business need to do so and for a period of time consistent with the original purpose as described in this Notice. We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of your personal information processed, the potential risk of harm from unauthorized use or disclosure of your personal information and whether we can achieve the purposes of the processing through other means, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation).

After expiration of the applicable retention periods, we will either delete or anonymize your personal information or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. MODIFICATIONS TO THIS NOTICE

When necessary, this Notice is subject to changes. The date of its most recent revision is noted at the beginning of this Notice. If we make material changes to this Notice, we will notify you either by posting a notice of such changes or by directly sending you a notification. We encourage you to review this Notice frequently to be informed of how MasterControl is protecting your information.

7. CONTACT US

If you have any questions or concerns that are not addressed in this Notice, or if you wish to exercise your privacy rights, or file complaints, please email your questions or requests to us at [email protected].