General Data Protection Regulation (GDPR) is a European Union regulation that establishes a new framework for handling and protecting the personal data of EU-based residents. It is the most comprehensive EU data privacy law in decades and comes into effect on May 25, 2018.
Besides strengthening and standardizing user data privacy across the EU nations, it will require new or additional obligations on all organizations that handle EU citizens’ personal data, regardless of where the organizations themselves are located.
GDPR is intended to offer protections for you or any identifiable natural person (the “Data Subject”) regarding your information (your “Personal Data”). You, as a Data Subject, have broad rights, whether you are identified directly or indirectly through interaction context in which your information was captured.
Under GDPR, you opt in to have an organization (the “Data Controller”) process your Personal Data. Data Controllers must obtain your consent before they can process your data.
Unless specifically authorized, GDPR prohibits processing of certain special categories of data such as race, ethnicity, political and religious beliefs, sexual orientation, genetic and biometric data. Clari does not acquire or process any data belonging to these categories.
If you consented to a Data Controller processing your Personal Data, you may then request the following:
You, as a Data Subject have the right to have any errors on inaccuracies of Personal Data corrected. Your Data Controller shall implement such requests without undue delay.
You have the right to have your Personal Data erased or forgotten. Your Data Controller shall remove your personal data and confirm deletion via a notification to you. Data Controllers are also required to maintain these transactions.
You have the right to have your Personal Data exported and provided to you in complete form.
In the event of a data breach and your Personal Data is compromised, your Data Controllers are required to notify you at least within 72 hours.
Clari is committed to partnering with its customers and users to ensure that Clari is fully compliant with the requirements of GDPR. Clari recognizes your rights under GDPR and will ensure that these rights are honored, and your Personal Data is protected. Clari’s product and security teams are working diligently to bring Clari’s product offerings and contractual commitments in line so our customers, prospects, users and others that interact with Clari are compliant before the May 25, 2018 deadline.
Measures to achieve this include:
We’ll also continue to monitor the guidance around GDPR compliance from privacy-related regulatory bodies, and will adjust our plans accordingly if it changes. We’ll provide you with regular updates along the way so that you’re always current.
Protecting our customers’ information and their users’ privacy is extremely important to us. As a cloud-based company entrusted with some of our customers’ most valuable data, we’ve set high standards for security. Clari has received internationally recognized security certifications for ISO 27001 (information security management system). Clari is also in the process of getting additional security certifications from the American Institute of Certified Public Accountants such as SOC 2 and SOC 3 and ISO 27018 (for protecting personal data in the cloud).
If you would like to learn more about Clari’s security policies and procedures, please see our security page.
To comply with E.U. data protection laws around international data transfer mechanisms, we self-certify under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield. These frameworks were developed to establish a way for companies to comply with data protection requirements when transferring personal data from the European Union and Switzerland to the United States.
In addition, we offer European Union Model Clauses, also known as Standard Contractual Clauses, to meet adequacy and security requirements for our customers who operate in the EU.
Your personal data may enter Clari’s processing scope in multiple ways. Based on how your personal data is consented to, who has control over the data and has responsibility for protecting and administering your rights, Clari is either a Data Controller or a Data Processor. This section describes Clari’s role as both a Data Controller and Processor, and explains how you can interact with Clari in either role.
When you interact with Clari via its marketing and sales development outreach programs as a website visitor, webinar participant or asset downloads, Clari is the primary Data Controller from GDPR perspective. In these cases, Clari is responsible for obtaining your consent and providing means for exercising your data rights.
Clari also ensures that any additional data it procures from third party services is obtained by that third party after obtaining your consent.
If you had previously provided consent to Clari to collect your personal data, you may choose to withdraw that consent at a later point. Please send an email request to email@example.com and we will implement the request, and provide a confirmation of your consent withdrawal via a reply email to your email address. The acknowledgement email will also provide you consequences of withdrawing your consent.
During the course of your registration process, we may offer certain preferences that control privacy of your data. Additionally, some registration processes may offer submission of certain data as optional items. You may choose not to provide optional data, but if you do provide them, Clari will track your submissions. Additionally, Clari will honor your choices and will ensure that these preferences and optional data are part of the data that you have access to via GDPR framework based requests.
Clari does not sell your Personal Data to any other third party organization. Clari also does not transfer the rights to your personal data to any other party nor does it use the data other than the original intent. Any transfer to a third party is solely intended for the processing of data and Clari has secured agreements with downstream Data Processors to protect Personal Data and enforce GDPR data rights for you.
As part of GDPR you have the right to request all Personal Data about you to be made available to you. We will provide:
To request this data, please contact firstname.lastname@example.org and we will respond within 72 hours of your request.
You may submit a request via email@example.com to delete all data about you. Clari will comply with this request, but will use your email to send a confirmation notice that we performed the requested action.
You may submit a request via firstname.lastname@example.org to update Personal Data that we have about you. Clari will perform this, and will use your email to send a confirmation notice that we performed the requested action. If email itself was requested to be changed, Clari will send a confirmation to both the old and new email.
You may also submit a request via email@example.com to request an export of all your data for data portability. Clari will provide this information via a CSV or JSON file. Such a report will include meta-data such as when particular data was added, any updates to the data etc. - i.e., an audit trail of the data.
We will notify you if your Personal Data was compromised via a breach using all methods contact information we have about you, within 72 hours. This includes any breach that was caused by a Data Processor that Clari has authorized to process your data.
Clari has put in place best-in-the-industry processes for providing you the rights to your personal data, per GDPR guidelines. In the event that you are not satisfied with our resolution of your requests, you have the right to file a complaint. Please submit a request via firstname.lastname@example.org to file a complaint. You also have a right to file a similar complaint with a supervisory authority for the jurisdiction you are in and seek appropriate remediation.
If we are processing your Personal Data on behalf of your employer or the organization, you may submit a request via email@example.com and Clari will forward the request to your employer. Any final action on the request will need to be approved by the employer (the Data Controller). Clari will assist the Data Controller in expeditiously completing the request.
When Clari processes and displays your personal data, that data was acquired from your employer or organization that you interact with. If it is personal data that you submitted to your employer, you provided consent to your employer to that data for their business purpose. If it is personal data that Clari’s customer obtained in the process of conducting business with you or your employer, they rely on your consent to use the data for business purpose. As an example, if you are a purchaser of a product from Clari’s customer, your relationship to our customer would be that of a vendor, and in furthering that relationship, our customer would have acquired your personal data.
To withdraw an earlier consent that you provided, contact your employer or the organization to which you provided the original Personal Data. Clari will not be able to alter your consent, as we are the Data Controller.
To request your Personal Data, please send a request to firstname.lastname@example.org. For data processed by Clari, we will forward your request to your employer (the Data Controller), who will then initiate a request to provide that information. Since Clari’s role is only that of a Data Processor, Clari will not be able to provide your Personal Data directly.
In the event of a data breach, Clari, as a Data Processor, is required to notify your employer/organization that there was a data breach. Your organization will then notify you regarding the breach, its impact and potential remedies. Clari will not notify you directly.
To request an export or erasure or update of Personal Data held by Clari, please send a request to email@example.com. We will forward your request to your employer/organization, who will then initiate a request Clari to complete the request. Since Clari’s role is only that of a Data Processor, Clari will not be able to perform these actions directly.
For filing a complaint related to personal data processed by Clari, use the complaint portal/form of your employer or organization (the Data Controller). Clari will assist the Data Controller in resolving the complaint, but will not take any action until and unless such action is authorized by the Data Controller.
Individuals from the EU may contact our EU representative according to Art. 27 GDPR regarding all requests related to data protection and privacy:
Tel.: +49 40 99999 - 3430
Mob.: +49 (0) 172 918 22 22
Clari as a Data Processor has engaged the services of the following sub-processors. Some or all of your personal data may be transferred to them. All such transfers are governed by Master Service Agreements and GDPR agreements (via Data Processing Addendum) that establish the scope of processing as well as legal basis for such processing. Clari requires its sub-processors to perform the specified processing only for the purposes of delivering the services that are part of the agreement. To learn more about the GDPR initiatives of our sub-processors, please visit the web pages listed here.
Clari will notify your GDPR and/or administrative contact if we add any new sub-processors to the list above. For additional details, please review Clari Data Processing Addendum below.