Version 2.4 Copyright Notice<\/b><\/span><\/p>\n \u00a92025 Pathlock, Inc. All Rights Reserved.<\/b><\/b><\/span><\/p>\n The information in this document is provided for informational purposes only, is subject to change without notice, and should not be construed as a commitment by Pathlock, Inc. Pathlock assumes no responsibility or liability for any errors or inaccuracies that may appear in this document.<\/span><\/p>\n Except as permitted by license, no part of this document may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means — electronic, mechanical, recording, or otherwise — without the prior written permission of Pathlock, Inc.<\/span><\/p>\n Printed in the U.S.A.<\/span><\/p>\n CAUTION<\/b><\/b><\/span><\/p>\n This document contains proprietary, confidential information that is the exclusive property of Pathlock, Inc. If you do not have a valid contract with Pathlock for the use of this document or have not signed a non-disclosure agreement with Pathlock, then you received this document in an unauthorized manner and are not legally entitled to possess or read it.<\/span><\/p>\n Use, duplication, and disclosure are subject to restrictions stated in your contract with Pathlock, Inc. Use, duplication, and disclosure by the Government are subject to restrictions for commercial software and shall be deemed to be Restricted Rights software under Federal Law.<\/span><\/p>\n Table of Contents<\/b><\/span><\/p>\n <\/b>1. Purpose and Scope<\/b><\/span><\/p>\n Pathlock, Inc., including its subsidiaries and affiliates (collectively, “Pathlock,” “we,” or “us”) respects the privacy of its customer data and is committed to protecting personal information in accordance with applicable data protection laws and industry standards.<\/span><\/p>\n This Services Privacy Policy (“Services Notice”) covers our privacy practices with respect to the collection, use, and disclosure of information obtained in connection with the purchase and use of our hosted software applications (the “Pathlock Cloud Platform”) and related support services (“Support Services”), as well as expert services, including professional services, training, and certification (the “Expert Services”) that we provide to Customers (defined below). In this Privacy Statement, the Pathlock Cloud Platform, Support Services, and the Expert Services are collectively referred to as the “Service.” This Service Privacy Policy also covers information processed by Pathlock for customer and partner account management purposes, including customer address and billing information collected for processing Customer’s purchase of Pathlock’s Service.<\/span><\/p>\n This Services Policy does not cover a customer’s use or disclosure of any information it stores in the Pathlock Cloud Platform. This Services Policy also does not cover any information or data collected by Pathlock for other purposes outside of the Service. This Services Notice also does not cover the use or disclosure of any information stored in the Pathlock Cloud Platform when hosted by the Customer.<\/span><\/p>\n For the purposes of this Services Policy:<\/span><\/p>\n “Customer” means the entity that purchases our Service.<\/span><\/p>\n “Customer Data” means the electronic data uploaded into the Pathlock Cloud Platform by or for Customer or its Users.<\/span><\/p>\n “Mobile Applications” means applications downloaded by an authorized user of our hosted software applications to a mobile device.<\/span><\/p>\n “User” means an individual authorized by the Customer or Partner to access and use the Pathlock Cloud Platform.<\/span><\/p>\n “Partner” means an entity that sells Pathlock products and services or provides services or technology to Pathlock customers.<\/span><\/p>\n “Personal Data” means any information relating to an identified or identifiable natural person as defined under applicable data protection laws.<\/span><\/p>\n “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.<\/span><\/p>\n 2. How We Obtain Information<\/b><\/span><\/p>\n As further described below, we collect several types of information from and about our Customers and Partners in the course of providing and supporting our Service.<\/span><\/p>\n Customers process Customer Data in the normal course of using our Service. Our use and access of Customer Data processed is limited to providing and supporting the Service and in accordance with the definitive agreement between Customer and Pathlock pursuant to which the Customer purchased access to the Pathlock Cloud Platform (the “Customer Agreement”) and our Data Processing Addendum (“DPA”).<\/span><\/p>\n We host and process Customer Data at the direction of and pursuant to the instructions of our Customers. We also collect several types of information from our Customers, including:<\/span><\/p>\n Information and correspondence our Customers and Users submit to us in connection with Expert Services or other requests related to our Service.<\/span><\/p>\n Information we receive from our business partners in connection with use of the Service or in connection with services provided by our business partners, including configuration of the Pathlock Cloud Platform.<\/span><\/p>\n Server logs in support of the Pathlock Cloud Platform.<\/span><\/p>\n Information collected via our Mobile Applications.<\/span><\/p>\n We also collect several types of information from and about our Customers and partners as a data controller, including:<\/span><\/p>\n General information, including a Customer or Partner’s company name and address, credit card information, and the Customer or Partner representative’s contact information (“General Information”).<\/span><\/p>\n Quantitative data derived from our Customers and Users use of the Pathlock Cloud Platform, for example and without limitation, the number of active roles within a Customer’s instance. All data collected, used, and disclosed will be in aggregate form only and will not identify Customer or its Users.<\/span><\/p>\n Service Data relating to the use, support and operation of the Services, which is collected directly by Pathlock from and about users of the Services and Customer’s use of the Service for use for its own purposes, certain of which may constitute Personal Data.<\/span><\/p>\n 3. How We Use Information<\/b><\/span><\/p>\n We may use Customer Data to provide and support the Service, including updating and maintaining the Pathlock Cloud Platform and providing Support and Expert Services. We will not use, disclose, review, share, distribute, transfer, or reference any Customer Data except as permitted in the Customer Agreement, as set forth in our DPA, or as required by law.<\/span><\/p>\n We may use information we collect about our customers and partners for billing and contracting purposes, to improve our services, for security and fraud prevention, and to comply with legal obligations.<\/span><\/p>\n We process Personal Data as a Processor on behalf of our Customers who are the Controllers of such data. Our processing activities are limited to those necessary to provide the Services as instructed by our Customers and in accordance with our DPA.<\/span><\/p>\n 4. How We Share Information Collected<\/b><\/span><\/p>\n We may disclose personal information that our Customers, Partners, and Users provide to us to the following categories of recipients:<\/span><\/p>\n To our subsidiaries and affiliates (including those located outside the European Economic Area, United Kingdom, and Switzerland) as necessary to support provision of the Service to the Customer and operate our partner program.<\/span><\/p>\n To our contractors, business partners and service providers we use to support our Service, including Sub-Processors as identified in our Sub-Processor List available at https:\/\/trustcenter.pathlock.com\/subprocessors<\/a>, and business partners who provide services on behalf of our Customers.<\/span><\/p>\n To a potential buyer (and its agents and advisors) in connection with any proposed merger, acquisition, or any form of sale or transfer of some or all of our assets (including in the event of a reorganization, dissolution or liquidation), in which case personal information held by us about our Customers and Partners will be among the assets transferred to the buyer or acquirer.<\/span><\/p>\n To any competent law enforcement body, regulatory, government agency, court or other third party to: (i) comply with any court order, a request from any competent law enforcement agency, or any other legal obligation; (ii) enforce or apply the terms of the Customer Agreement; (iii) enforce or apply the terms of the agreement for partnership with our Partners; and (iv) protect the rights, property, or safety of Pathlock, our Customers, Users, or others.<\/span><\/p>\n In accordance with Customer instructions as documented in the Customer Agreement and DPA.<\/span><\/p>\n 5. International Transfers<\/b><\/span><\/p>\n We store and process Customer Data in: (i) any country where we have facilities, and (ii) any country in which we engage service providers, including Sub-Processors.<\/span><\/p>\n For international transfers of personal information from the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we implement appropriate safeguards to ensure adequate protection for the transferred Customer Data. These safeguards include:<\/span><\/p>\n For EEA transfers, we utilize the European Commission’s Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021\/914, as incorporated into our DPA.<\/span><\/p>\n For UK transfers, we utilize the UK Transfer Addendum to the SCCs, as approved by the UK Information Commissioner’s Office and incorporated into our DPA.<\/span><\/p>\n For Swiss transfers, we implement appropriate safeguards as required under Swiss data protection law.<\/span><\/p>\n We maintain a current list of countries where Customer Data may be processed, which is available upon request. All international transfers are conducted in accordance with Chapter V of the GDPR and equivalent provisions in other applicable data protection laws.<\/span><\/p>\n Our Sub-Processors who may process Customer Data internationally are bound by contractual obligations that provide equivalent levels of data protection as those set out in our DPA and applicable SCCs.<\/span><\/p>\n 6. Security and Breach Notification<\/b><\/span><\/p>\n We maintain a comprehensive information security program designed to protect Customer Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Our security measures are aligned with industry standards and best practices, including those required for ISO 27001, SOC 1 Type 2, SOC 2 Type 2, and TISAX compliance.<\/span><\/p>\n Our technical and organizational security measures include:<\/span><\/p>\n Organizational management with dedicated staff responsible for the development, implementation and maintenance of our information security program.<\/span><\/p>\n Data security controls including logical segregation of data, role-based access controls, monitoring, and utilization of industry-standard encryption technologies for Customer Personal Data both in transit and at rest.<\/span><\/p>\n Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, with multi-factor authentication where appropriate.<\/span><\/p>\n Regular security assessments, vulnerability scanning, and penetration testing to identify and address potential security risks.<\/span><\/p>\n Incident response procedures designed to investigate, respond to, mitigate and notify of security events.<\/span><\/p>\n Physical security controls for data centers and facilities where Customer Data is processed.<\/span><\/p>\n Regular security awareness training for all personnel with access to Customer Data.<\/span><\/p>\n The Pathlock Cloud Platform allows Customers to implement and configure their use of the platform and enforce their security requirements, including user access controls and encryption.<\/span><\/p>\n Pathlock has a dedicated team responsible for monitoring and responding to security incidents. In the event of a Personal Data Breach, we will notify affected Customers without undue delay and in accordance with the requirements set forth in our Customer Agreement and DPA. Our notification will include sufficient information to allow Customers to meet their own obligations under applicable data protection laws, while not compromising the security of other Customer Data.<\/span><\/p>\n We maintain certifications and undergo regular audits for ISO 27001, SOC 1 Type 2, and SOC 2 Type 2 compliance. Audit reports are available to Customers upon request and subject to appropriate confidentiality agreements. For customers in the automotive sector requiring TISAX compliance, we implement additional controls to protect confidential automotive industry information in accordance with VDA ISA requirements.<\/span><\/p>\n 7. Retention<\/b><\/span><\/p>\n We retain Customer Data according to the timeframes set forth in the Customer Agreement and DPA. Specifically:<\/span><\/p>\n During the term of the Service, we retain Customer Data as necessary to provide the Services.<\/span><\/p>\n Upon termination or expiration of the Service, we provide a post-cessation storage period of fourteen (14) days during which Customers may request return or deletion of their Customer Data.<\/span><\/p>\n After the post-cessation storage period, if no instruction is received, we will delete or irreversibly anonymize Customer Data to the fullest extent technically possible.<\/span><\/p>\n We may retain Customer Data where permitted or required by applicable law, for such period as may be required by such applicable law, provided that we maintain the confidentiality of all such Customer Personal Data and process it only as necessary for the purpose specified in the applicable law.<\/span><\/p>\n We retain General Information where we have an ongoing legitimate business need to do so, for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements.<\/span><\/p>\n Retention periods may vary based on the nature of the data and applicable legal requirements. We regularly review our retention practices to ensure compliance with applicable data protection laws.<\/span><\/p>\n 8. Your Privacy Rights<\/b><\/span><\/p>\n Since each Customer is in control of what information, including any personal information, it collects from its Users, how that information is used and disclosed, and how that information can be changed, Users of the Pathlock Cloud Platform must contact the applicable Customer administrator with any inquiries about how the Customer uses and discloses personal information.<\/span><\/p>\n Users should contact their Customer administrator to exercise rights to access, rectify, correct, delete, and port personal information contained in Customer Data as well as object to or restrict the processing of personal information contained in Customer Data.<\/span><\/p>\n We provide you with certain choices regarding the General Information you provide to us. In particular:<\/span><\/p>\n To access, correct, update, or request deletion of any personal information Customer or Partner provided us as part of the General Information, please contact your account representative or Pathlock relationship manager or, where possible, use our portals you have access to (for example, our partner portal) to carry out these requests.<\/span><\/p>\n Certain jurisdictions, including the European Economic Area, United Kingdom, and California, provide their residents specific privacy rights under applicable law. We will process requests to exercise such rights, including objection to and restriction of processing and requests for portability of personal information contained in General Information, in accordance with applicable data protection laws.<\/span><\/p>\n Under the GDPR, data subjects have the right to lodge a complaint with a supervisory authority if they believe their personal data has been processed in violation of applicable data protection laws.<\/span><\/p>\n
\n<\/b>(Updated September 2025)<\/b><\/span><\/p>\n\n