EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).
Inflectra is the creator of certain software products, and in connection with these software products, Inflectra provides product demonstrations, product development, product enhancements, cloud services, solution engineering services, professional technical services, data migration services, and product technical support services (collectively “Services”) for the benefit of its customers and prospective customers in the EEA, the UK, and Switzerland through employees who may be located in the U.S. These U.S.-based employees may process Personal Data to provide Services to customers and prospective customers located in the EEA, the UK, and Switzerland.
Customers using Inflectra’s cloud solutions are responsible for managing the data that they store within Inflectra’s cloud solutions. Customers determine the categories of Personal Data and other information that are stored by Inflectra. Similarly, Inflectra's customers and prospective customers who share data with Inflectra in connection with any of its Services determine which categories of Personal Data will be shared and for what purposes. Consequently, Inflectra does not generally know the categories of Personal Data to be processed or the purpose(s) of the processing unless and until Inflectra receives this information from its customers or prospective customers.
When Inflectra processes Personal Data, Inflectra does so only for the purpose of providing Services.
Inflectra customers and prospective customers may choose to include Personal Data among the data stored within the Inflectra cloud or otherwise shared with Inflectra in connection with its provision of Services.
Inflectra processes only the Personal Data that its customers or prospective customers have chosen to share with Inflectra. Inflectra has no direct or contractual relationship with the subject of such Personal Data (a "Data Subject"). As a result, when a customer or prospective customer shares Personal Data, the customer or prospective customer is solely responsible for satisfying all legal obligations owed directly to the Data Subject under applicable data protection laws.
It is the customer's or prospective customer's responsibility to ensure that Personal Data it collects can be legally collected in the country of origin. The customer or prospective customer is also responsible for providing to the Data Subject any notices required by applicable law and for responding appropriately to the Data Subject's request to exercise his or her rights with respect to Personal Data. In addition, the customer or prospective customer is responsible for ensuring that its use of Inflectra’s cloud offerings or Services is consistent with any privacy policy the customer or prospective customer has established and any notices it has provided to Data Subjects.
Inflectra is not responsible for its customers’ or prospective customers’ privacy policies or practices or for the customers’ or prospective customers’ compliance with such policies or practices. Inflectra does not review, comment upon, or monitor its customers’ or prospective customers’ privacy policies or their compliance with such policies. Inflectra also does not review instructions or authorizations provided to Inflectra to determine whether the instructions or authorizations are in compliance with, or conflict with, the terms of a customer's or prospective customer's published privacy policy or of any notice provided to Data Subjects. Customers and prospective customers are responsible for providing instructions and authorizations that comply with their policies, notices, and applicable laws.
- NOTICE. Inflectra complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Inflectra has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Inflectra has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/
- CHOICE. During initial user registration, users can choose whether they wish to share their information with authorized third parties located in the same geography to aid in the software evaluation process. Users always have the opportunity to opt–out or change preferences via a link in the footer of all non–transactional email messages. These options are made available in email messages delivered from our company. Alternatively, you may manage your preferences in the secure customer area of our website or simply email us at privacy@inflectra.com. Some communications (e.g. important account notifications, evaluation support information and billing information) are considered transactional and are necessary for all Inflectra customers and users. You must cancel your Inflectra account to unsubscribe from these communications. To cancel your Inflectra account, please email us at
sales@inflectra.com.
- ACCESS. Data Subjects have the right to access the Personal Data an organization holds about them. If such Personal Data is inaccurate or processed in violation of the DPF Principles, a Data Subject may also request that Personal Data be corrected, amended, or deleted.
When Inflectra receives Personal Data in the role of data processor, it does so on its customer's or prospective customer's behalf. To request access to, or correction, amendment or deletion of, Personal Data, Data Subjects should contact the Inflectra customer or prospective customer that collected their Personal Data. Inflectra will cooperate with its customers' and prospective customers' reasonable requests to assist Data Subjects to exercise their rights under the DPF. Should Data Subjects not receive a response from the customer or prospective customer, they should contact Inflectra directly to escalate.
When Inflectra receives Personal Data in the role of data controller, to request access to, or correction, amendment or deletion of, Personal Data, Data Subjects should contact Inflectra directly in the first instance.
- SECURITY. Inflectra is committed to safeguarding the Personal Data that it receives. While Inflectra cannot guarantee the security of Personal Data, Inflectra takes reasonable and appropriate measures to protect Personal Data in Inflectra’s possession from loss, misuse, unauthorized access, disclosure, alteration and destruction.
Inflectra utilizes a combination of online and offline security technologies, procedures and organizational measures to help safeguard Personal Data. For example, facility security is designed to prevent unauthorized access to Inflectra computers. Electronic security measures — including, for example, network access controls, passwords and access logging — provide protection from hacking and other unauthorized access. Inflectra also protects Personal Data through the use of firewalls, role-based restrictions and, where appropriate, encryption technology. Inflectra limits access to Personal Data to employees, subcontractors, and third-party agents that have a specific business reason for accessing such Personal Data. Individuals granted access to Personal Data are aware of their responsibilities to protect such information and are provided appropriate training and instruction.
- DATA INTEGRITY AND PURPOSE LIMITATION. Inflectra's customers and prospective customers are responsible for limiting their collection of Personal Data to that which is necessary to accomplish the purposes disclosed to Data Subjects and compatible purposes. They also are responsible for providing Inflectra with instructions or authorization for the processing of Personal Data consistent with such purposes.
Inflectra's customers and prospective customers also are responsible for ensuring that (a) Personal Data they collect is accurate, complete, current and reliable for its intended uses; and (b) Personal Data is retained only for as long as is necessary to accomplish the customer's or prospective customer's legitimate business purposes disclosed to the Data Subject and for compatible purposes. Inflectra will cooperate with customers' and prospective customers' reasonable requests for assistance in meeting these obligations.
In the performance of Services, Inflectra will request only the minimum amount of information required to perform the applicable Services and will retain such information only for as long as necessary to provide the Services or for compatible purposes, such as to provide additional Services, to comply with legal requirements, or to preserve or defend Inflectra’s legal rights.
- RECOURSE, ENFORCEMENT & LIABILITY. Please see the separate "Independent Recourse" section below for details on how to contact us with a privacy question or complaint and your independent recourse should you not be satisfied.
- ONWARD TRANSFER. Inflectra may disclose Personal Data to subcontractors and third-party agents who assist Inflectra in providing Services to its customers and prospective customers. Before disclosing Personal Data to a subcontractor or third-party agent, Inflectra will obtain assurances from the recipient that it will: (a) use the Personal Data only to assist Inflectra in providing the Services; (b) provide at least the same level of protection for Personal Data as required by the DPF Principles; and (c) notify Inflectra if the recipient is no longer able to provide the required protections. Upon notice, Inflectra will act promptly to stop and remediate unauthorized processing of Personal Date by a recipient. Inflectra will remain liable for onward transfers to its subcontractors and third-party agents.
Inflectra may also be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements. To the extent permitted, Inflectra will inform its relevant customer or prospective customer before making such disclosure and provide it with a reasonable opportunity to object to such disclosure.
Inflectra will not otherwise disclose Personal Data to third parties.
- ENFORCEMENT. As part of the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, Inflectra is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
- ARBIRTRATION. Under certain conditions, more fully described on the Data Privacy Framework website – Annex I, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.