Legal

Privacy Policy

2024-05-08

This Website Privacy Policy (“Privacy Policy”) describes the privacy practices of Pinecone Systems, Inc. and that of its subsidiaries and affiliates (collectively, “Pinecone,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, secure and otherwise process personal information from individuals in connection with our website and any other website that we own or control and which posts or links to this Privacy Policy (collectively, the “Websites”), as well as our marketing activities, corporate events, conferences and other live events, and the rights and choices available to individuals with respect to their information. Pinecone may provide additional or supplemental privacy policies to individuals for specific products or services that we offer at the time we collect personal information. These supplemental privacy policies will govern how we may process the personal information in the context of the specific product or service.

This Privacy Policy does not govern how we may process personal information on behalf of our enterprise customers as part of the Pinecone Services. We process such personal data only as instructed by our customers and in accordance with a data processing agreement between our customers and us.

We provide important information for individuals located in the European Union, European Economic Area, Switzerland and United Kingdom (collectively, “Europe” or “European”) below.

Information Collected

FROM WHOM WE COLLECT PERSONAL INFORMATION

Our customers. Those who register on their own or on behalf of an entity or organization to use any of our Services (as defined below), including administrators on a customer account. For the purposes of this Policy, “Services” shall refer to all products or service offerings made available by us.

Our website Visitors. Individuals who visit our Websites and who may volunteer certain contact data (such as their email address) to receive communications from us. For the purposes of this Policy, “Websites” shall refer collectively to pinecone.io. For clarity, “Websites” does not include any sites owned or operated by our customers.

Our corporate events, conferences, or other live event attendees. Individuals who register on their own or on behalf of an entity or organization to attend one of our corporate events, conferences, or other live events.

WHAT PERSONAL INFORMATION WE COLLECT.

We collect personal information directly from you through your use of our Websites. This information may include:

Business contact data, such as your name, email address, and phone number. If you choose to log in, access or otherwise connect to the Services through networking service (such as Google or GitHub), we may collect your user ID and/or username associated with that social networking service, as well as any information you make public using that social networking service or that the social networking service allows us to access.
Employment information, such as your employer’s name and job title.
Location information, such as when you authorize our Websites to access your general location information such as city, state or geographic area.
Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online or at one of our corporate events.
Usage information, such as information about how you use the Websites and interact with us, including information associated with any information you provide when you use any features of the Websites.
Marketing information, such as your preferences for receiving communications from us and details about how you engage with our communications.
Other information that we may collect that is not specifically listed here but that we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

We may maintain pages about us on social media platforms such as Facebook, LinkedIn, Twitter and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platforms, and we will treat such information in accordance with this Privacy Policy.

Information that we obtain from other third parties.

We may receive personal information about you from third-party sources. For example, a business partner may share your contact information with us if you are attending a jointly sponsored corporate event or have otherwise expressed interest in learning specially about our services. We may obtain your personal information from other third parties such as marketing and advertising partners, publicly-available sources and data providers.

Referrals.

Website visitors may have the opportunity to refer contacts to us. You may only submit a referral if you have permission to provide the referral’s contact information to us so that we may contact them.

Use of Information

We may use your personal information for the following purposes or as otherwise described in this Privacy Policy or at the time of collection:

To operate the Websites and our business. We may use personal information to operate the Websites and our business and to provide related services, including to:

provide, operate and improve the Websites and our business;
provide information about our services and product offerings;
enable security features of the Websites;
understand your needs and interests, and personalize your experience with the Websites and our communications;
respond to your requests, questions and feedback;
communicate with you about corporate events;
protect the security of the Websites and our systems; and
provide you with customer support when needed.

For research and development. We may analyze use of the Websites to evaluate and improve the Websites, including by studying user demographics and use of the Websites.

Advertising. We may also work with third-party advertising partners to collect statistics about the usage of our Websites, perform analytics, deliver content which is tailored to your interests and administer services to our Users, advertisers, publishers, customers and partners.

To comply with law. We may use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

For compliance, fraud prevention and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Websites; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

With your consent. In some cases, we may specifically ask for your consent to collect, use or share your personal information, such as when required by law.

Data sharing in the context of corporate events. We may share certain personal information in the context of actual or prospective corporate events – for more information, see Sharing of Information below.

To create anonymous, aggregated or de-identified data. We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect, by removing the information that makes the data personally identifiable to you. We may use and share such anonymous, aggregated or de-identified data for any purpose we deem appropriate, such as to maintain and improve the Website.

To send you marketing and promotional communications. We may send you Pinecone-related marketing and promotional communications about the products or services that we offer. You will have the ability to opt-out of our marketing and promotional communications as described in the “Options” section below.

We may share personal information with the following categories of recipients:

Service providers. We work with service providers that work on our behalf that may need access to certain Personal Data in order to provide their services to us. These companies may include, but are not limited to, cloud storage providers, analytics services, fraud prevention, identity verification providers, etc. We may share your personal information with third-party companies and individuals that provide services on our behalf or help us operate the Websites (such as customer support, hosting, analytics, email delivery, marketing and database management services).

Payment processors. We share your payment information with third party payment processors, for the purpose of facilitating your payments when using our Services. These third parties may have access to your Personal Data so that they may perform these tasks on our behalf.

Third party advertisers. We may partner with third parties to either display advertising on our Services or to manage our advertising on other websites or apps. Our third party advertisers may use Tracking Technologies to gather information about your activities on our Services and other websites and apps in order to provide you advertising based upon your browsing activities and interests.

Third Party Integrations. The Services allow you to integrate with certain third-party services, such as in order to connect your Facebook or Apple account to our Services or to place purchases, in which case you will be bound by the terms and conditions and privacy notices of said third parties (e.g., Google or GitHub). Please make sure that you read and accept them in advance. We do not receive or store your passwords for any of these third party services.

Business partners. We may share your personal information with third parties with whom we partner, including parties with whom we may co-sponsor corporate events or promotions, with whom we jointly offer products or services, or whose products or services may be of interest to you.

Professional advisors. We may share your personal information with professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. We may share your personal information with law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance, fraud prevention and safety purposes described above.

Business transferees. We may share your personal information with relevant participants in business transactions (or potential transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, (including, in connection with a bankruptcy or similar proceedings).

Options

Access or update information. If your personal information changes, or if you no longer desire to have a relationship with us, you may correct or update by emailing privacy@pinecone.io. We will respond to your request within a reasonable timeframe.

Information about Children

Our Websites are not directed to children under 16. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at privacy@pinecone.io. We will delete such information from our files as soon as reasonably practicable.

Security

We maintain various physical, electronic and procedural safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of personal information.

Third-Party Websites

The Websites may contain links to websites and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third-party and we cannot control, and take no responsibility for, the content or privacy practices of such third-party websites or online services operated by third parties. We encourage you to review the privacy policy and any other applicable terms for such third-party websites or online services operated by third parties.

International Data Transfers

We are headquartered in the United States and may have service providers in other countries, and your personal information may be transferred to the United States or other locations outside of your state, province, or country where privacy laws may not be as protective as those in your state, province, or country.

European users should read the important information provided in the “Notice to European Users” section to learn more about transfer of personal information outside of Europe.

Privacy Policy Updates

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Websites. If required by law, we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email or another manner through the Websites.

Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your continued use of the Websites after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

Contact

If you have any further questions concerning this Privacy Policy, or would like to request to correct, update, or delete such information, please contact privacy@pinecone.io or mail us at:

Pinecone Systems, Inc
548 Market St
PMB 19327
San Francisco, CA 94104-5401

Notice to European Users

The information provided in this “Notice to European Users” section applies only to individuals in Europe.

Personal information. References to “personal information” in this Privacy Policy are equivalent to “personal data” governed by European data protection laws.

Controller and EU Representative. Pinecone Systems, Inc. is the controller of your personal information covered by this Privacy Policy for purposes of European data protection laws.

Legal bases for processing. We use your personal information only as permitted by law. Our legal bases for processing the personal information described in this Privacy Policy are described in the table below.

Use for new purposes. We may use your personal information for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Processing purpose (click link for details) Details regarding each processing purpose listed below are provided in the section above titled “Use of Personal Information”.	Legal basis
To operate the Websites	Processing is necessary to perform the contract governing our provision of services to you or to take steps that you request prior to entering an agreement for our services. If we have not entered into a contract with you, we process your personal information based on our legitimate interest in providing our services (including our Website) to you.
For research and development	These activities constitute our legitimate interests. We do not use your personal information for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Processing activities are necessary for the performance of a contract to which you are a party or a representative of a party.
- For compliance, fraud prevention and safety - Provision of our Services; support.	The legal bases for processing this data are the performance of our contractual obligations towards you; your consent (for example, when you provide Personal Data); compliance with our legal obligations; and our legitimate interests. Our legitimate interests in this case are enforcing our policies, protection against fraud and misuse of our Services.
To send you marketing and promotional communications	The legal bases for processing this data are your consent (where required) and our legitimate interests. Our legitimate interests in this case are providing you with tailored services, content and advertisements that better correspond with your interests.
To comply with law	Processing is necessary to comply with our legal obligations.
With your consent	Processing is based on your consent. Where we rely on your consent you have the right to withdraw it any time in the manner indicated when you consented.

Sensitive personal information

We ask that you not provide us with any sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Websites, or otherwise to us. If you provide us with any sensitive personal information when you use the Websites, you must consent to our processing and use of such sensitive personal information in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal information, you must not submit such sensitive personal information through our Websites.

Retention

We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

Your rights

European data protection laws give you certain rights regarding your personal information. If you are located within Europe, you may ask us to take the following actions in relation to your personal information that we hold:

Access. Provide you with information about our processing of your personal information and give you access to your personal information.
Correct. Update or correct inaccuracies in your personal information.
Delete. Delete your personal information.
Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
Restrict. Restrict the processing of your personal information.
Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.

You may submit these requests by email to privacy@pinecone.io or our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

End users: We have no direct relationship with end users. Even where we may be indicated as the authoritative name server for a domain, unless we are the owner of that domain, we have no control over a domain’s content. Accordingly, we rely on our customers to comply with the underlying legal requirements for subject access requests. If an End User requests that we access, correct, update, or delete their information, or no longer wishes to be contacted by one of our customers that use our services, we will direct that End User to contact the customer website(s) with which they interacted directly. Our customers are solely responsible for ensuring compliance with all applicable laws and regulations with respect to their website users.

Cross-Border Data Transfer

Please note that our businesses, as well as our trusted partners and service providers, are located around the world. Any information that we collect (including your personal information) is stored and processed in various jurisdictions around the world (including in the United States), for the purposes detailed in this Privacy Policy. Please note that some data recipients may be located outside the European Economic Area (the “EEA”) or the United Kingdom ("UK") In such cases we will transfer your data only to such countries as approved as providing adequate level of data protection as required by the relevant jurisdiction or enter into legal agreements ensuring an adequate level of data protection.

Whenever we share personal information originating in the EEA, the UK or Switzerland with a Pinecone entity located outside the EEA, the UK or Switzerland, we do so in accordance with the EU standard contractual clauses or other applicable frameworks..

Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Pinecone Systems, Inc has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:

by using EDPO's online request form https://edpo.com/gdpr-data-request/
by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium

Pursuant to Article 27 of the UK GDPR, Pinecone Systems, Inc has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

by using EDPO's online request form https://edpo.com/uk-gdpr-data-request/
by writing to EDPO UK at EDPO UK Ltd, Unit 33, Waterside, Schooner Court, 44-48 Wharf Road, London, N1 7UX, United Kingdom