Get in Touch

EEA+ Privacy Statement

Supplemental EEA+ Privacy Statement

The EU General Data Protection Regulation and the data protection laws of the UK and Switzerland require us, Gloo, LLC, to provide additional and different information about our data processing practices to data subjects in the European Economic Area (EEA), UK and Switzerland (collectively, “EEA+”).

Scope

If you are located in the EEA+ and receive services directly from us, we operate such services for our own purposes, and the Privacy Statement for that service includes a link to this Supplemental EEA+ Privacy Statement, this Supplemental EEA+ Privacy Statement applies to you.

Who is the Data Controller?

The data controller is Gloo, LLC, 831 Pearl Street, Boulder, Colorado, 80302, privacy@gloo.us.

What is our Legal Basis for Processing Your Personal Data?

We rely on the following legal bases to process your personal data, as appropriate:
The processing is necessary for us to perform a contract with you or take steps at your request prior to entering into a contract (“Contract Performance Legal Basis”);

  • The processing is necessary for us to comply with an applicable legal obligation (“Legal Obligation Legal Basis”);
  • The processing is necessary to protect your vital interests or those of another natural person (“Vital Interests Justification”);
  • The processing is necessary for us to realize a justified interest based on an assessment of our legitimate interests and your privacy and other fundamental interests (“Legitimate Interest Legal Basis”); and
  • The processing is performed according to your consent (“Consent Legal Basis”).

The specific legal bases on which we rely depend on the circumstances in which we received your personal data. The following table sets forth examples of the legal bases we generally rely on for the listed processing purposes. Please contact us at privacy@gloo.us if you have specific questions about the lawful basis that applies to our processing of your personal data.

Processing Purpose Legal Basis
  • Create an account for you or the organization for which you work;
  • Enable you to use online interactive forums we may offer;
  • Fulfill your orders for products and services;
  • Update your account, orders and transactions; and
  • Discharge our contractual obligations to you.
Contract Performance Legal Basis based on our Terms of Service or other applicable contract.
  • Provide requested services and information; and
  • Respond appropriately to your inquiries.
If your request or inquiry relates to a service you have ordered, requested or otherwise contracted for, Contract Performance Legal Basis based on the applicable contract.
 
If we are legally obligated to respond to your request or inquiry, Legal Obligation Legal Basis.
 
In all other cases, Legitimate Interest Legal Basis as part of our commitment to provide you with good service
  • Comply with any legal obligations that apply to us.
We process the personal data you submit in your initial submission on the basis of the Consent Legal Basis.
 
We process any personal data that you provide as part of our follow-on interactions with you to comply with our legal obligations, pursuant to the Legal Obligations Legal Basis, and to pursue legitimate interests, including to evaluate your credentials to determine whether to hire you, pursuant to the Legitimate Interest Legal Basis.
  • Send you marketing emails to a designated email address.
Consent Legal Basis.
  • Disclose your personal data to our service providers.
We disclose personal data to our service providers who help us fulfil the purposes above, in which case the above legal bases generally apply.

 

 

  • Disclose your personal data as required by applicable law, such as in response to any government or regulatory agency request, to cooperate with law enforcement investigations, or upon receipt of any court order.
  • Disclose your personal data to courts and public authorities to protect you, us, or third parties from harm, including fraud or instances where somebody’s physical safety is at risk.
If necessary to comply with applicable laws, Legal Obligations Legal Basis per applicable laws.
 
If necessary to protect vital interests of a natural person, Vital Interests Justification.
 
In all other applicable cases, Legitimate Interest Legal Basis to prevent fraud, danger or other
  • Disclose your personal data to a prospective or actual purchaser or seller in the context of a merger, acquisition or other reorganization or sale of our business or assets.
If the confidential processing of your personal data is necessary for us to evaluate or execute such a transaction while protecting our trade secrets or sensitive business information and your privacy interests do not override such interests, Legitimate Interest Legal Basis based on the pursuit of such legitimate interests.
 
In all other cases, we will obtain your consent and rely on the Consent Legal Basis.
 

How Do We Protect Your Personal Data in the Context of International Data Transfers?

Some recipients of your personal data located outside of the European Economic Area (“EEA”) are located in countries for which the European Commission has issued adequacy decisions, namely: Andorra, Argentina, Canada, Switzerland, Japan, Faeroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand and Uruguay. In each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective (GDPR Art. 45).

Some recipients of your personal data are located in countries for which the European Commission has not issued an adequacy decision in respect of the level of data protection there, namely: USA, Andorra, Argentina, Canada, Switzerland, Faeroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand and Uruguay where personal data is transferred. By entering into appropriate data transfer agreements based on Standard Contractual Clauses (2010/87/EU and/or 2004/915/EC) as referred to in GDPR Art. 46(5) or other adequate means, we have established that all such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law.

You can ask for a copy of such appropriate data transfer agreements by emailing privacy@gloo.us.

How Long Do We Retain Personal Data?

How long we retain your personal data depends on the context in which and purposes for which we collected and process your personal data. Your personal data will not be kept in a form that allows you to be identified for any longer than is necessary for achieving the purposes for which it was collected or processed or for us to comply with our legal obligations. If you have questions about how long we retain your personal data specifically, please email privacy@gloo.us.

What Rights Do You Have?

Subject to the conditions set out under the GDPR, you have the following rights:

  • Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data, in which case such processing may be required to cease.
  • Right of access: You have the right to know whether your Personal Data is being processed, and, where that is the case, to request access to the Personal Data. The access information includes, among other things, the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipients to whom your Personal Data have been or will be disclosed. You have the right to obtain a copy of your Personal Data undergoing processing.
  • Right to rectification: You have the right to rectify inaccurate Personal Data concerning you. Depending on the purposes of the processing, you have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
  • Right to erasure (to be forgotten): You have the right to have your Personal Data erased in certain cases.
  • Right to restriction of processing: You have the right to have the processing of your Personal Data restricted in certain cases.
  • Right to data portability: You have the right to receive your Personal Data which you provided in a structured, commonly used and machine-readable format and you have the right to transmit the Personal Data to another entity.
  • Right to withdraw your consent: If you declared your consent regarding certain types of processing activities, you can withdraw this consent at any time with future effect.

Please note that these rights might be limited under applicable national data protection laws. You also have the right to lodge a complaint with the competent supervisory authority. If you would like to exercise any of these rights, please contact us via the details listed below.

Your Choices

You are not required to provide any personal data to us but if you do not provide any personal data to us, you may not be able to use our services or we may not be able to authenticate and assist you with your inquiries or requests.

You can use our website, services and do business with us without consenting to our processing of your personal data for marketing purposes; the only consequence is that our website, services and marketing activities will be less tailored to you and you may miss out on relevant business opportunities.

If you are interested in an employment position with us but do not want to submit your employment application via our website, please do not submit any information or apply for a job through our website.  You may alternatively contact us at the contact information provided below for further information on how to apply for a position.  We will in any case need to collect certain personal data from you to assess your employment application.

Contact Us

If you have any questions, comments, or complaints concerning our privacy practices, please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information. In some cases, we may have to direct you to the third party which controls your personal data.

Data Protection Officer

Gloo
831 Pearl Street
Boulder, CO 80305
support@gloo.us

Last Revised: December 30, 2019