Kumo.ai, Inc. 

Privacy Policy

Effective Date: June 7, 2024 

(Superseding earlier version dated March 27, 2024)

California Notice at Collection: If you are a California resident, see the CALIFORNIA PRIVACY RIGHTS STATEMENT section below for important information about your rights under California law.  If you are located in the European Economic Area, UK, or Switzerland, please also see the SUPPLEMENTAL EUROPEAN PRIVACY STATEMENT below. 

Your privacy is important to Kumo.ai, Inc. (“Kumo,” “we,” “us” or “our”). This Privacy Policy describes how Kumo collects, uses, discloses, and otherwise processes Personal Information (as defined below) in connection with our websites (the “Site”) and SaaS AI services made available to our customers by subscription (“Service”). It does not address our privacy practices relating to Kumo job applicants, employees, and other personnel.  The written agreement between you and Kumo governs any conflict with this Policy.

If  you do not understand or agree with this Privacy Policy or our Terms of Service https://kumo.ai/terms-and-conditions or our Cookie Policy, please do not use the Site or  our Service or submit your Personal Information to us.

1.   What is Personal Information?

“Personal Information” means any data or information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person or household or any other data or information that constitutes “personal data,” “personal information,” or “personally identifiable information” which is governed by applicable law. 

2.   What Personal Information Do We Collect?  

We collect Personal Information you choose to provide us when, for example, you browse our Site, send marketing communications, subscribe to our Service, demo our Service, register for an account with us, submit a Service request or inquiry or otherwise communicate us. When using the Service, you, alone, in your sole judgment, elect to provide us with Personal Information based on your use case for the Service and the applicable business agreement.  

The categories and specific types of Personal Information collected from you has included: 

• Contact information/identifiers including your name, job title, business address or location, and/or email address.
• Sensitive Personal Information including passwords and other authentication credentials to your account.
• Financial information as needed to qualify for payment terms or to pay for subscription fees and other costs.

We may also collect Personal Information automatically in connection with your device when you visit or interact with our Site or when you use our Service, for example: 

• Log Data including internet protocol (IP) address, operating system, device type and version, browser type and version, browser id, the URL entered and the referring page/campaign, date/time of visit, other user agent string data, the time spent on our Site or using the Service, and any errors that may occur during your visit to our Site or using our Service. Log data may overlap with the other categories of data below. 
• Analytics data including the electronic path you take to our Service, through our Service and when exiting our Service, UTM source, as well as your usage and activity on our Service, such as the time zone, activity information (first and last active date and time), usage history (flows created, campaigns scheduled, emails opened, total log-ins) as well as the pages, links, objects, products and benefits you view, click or otherwise interact with.  
• Location data such as general geographic location that we or our third-party providers may derive from your IP address. 
• Public Information about You: If you have an interest in our Service, have expressed interest in our Service or identified yourself to us as a user of our Services, we may collect Personal Information about you from publicly available sources, namely, your company, contact information, preferences and demographic information. These publicly available sources include public profiles on company websites and professional networking.
• Audiovisual Information about You: Photograph, and images/footage captured/recorded on CCTV or other audio, video and related security/monitoring systems or captured during marketing/public filming events/sessions (including recording of virtual or live workshops or other events/sessions).
• Marketing Information: Your preferences for receiving our marketing communications and details about your engagement with them.

3.   How Do We Use Your Personal Information?

We use your Personal Information as necessary to provide, support, safeguard, improve and optimize the Service, to enable use of the Services in accordance with our business agreement, to comply with your instructions and to grow our business including the following:  

• Contact and Request Information to respond to your comments, questions and requests, to notify you of support  matters (e.g. upgrades, updates, etc.) and administer support, to allow access to our offices or facilities, to administer marketing and sales events and to otherwise communicate with you about your account. As permitted by applicable law, including with your consent as required, we may use your contact information to provide you with marketing communications, promotional offers and updates on new services and benefits. 
• Account Information to register you (and your authorized users) as users and to identify you when you sign in to your account, to administer, manage and communicate with you about your account, to provide technical support and customer service including providing Service updates and warranty information, and monitor the performance of our Service.
• Site Information to monitor the performance of our Sites and Service, analyze trends, usage and activities in connection with our Sites, Services, and support their technological compatibility with users.  We also use Site Information for targeted advertising purposes where permitted by applicable law.
• Our third-party advertising partners may use cookies and other technologies to collect Site Information and other information, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate such advertising to those or similar users on other online platforms.
• We use third-party analytics tools, such as Google Analytics, to recognize you to recognize you and link the devices you use when you visit our Service on your browser or mobile device, log in to your account on our Services, or otherwise engage with us.  We share a unique identifier, like a user ID or hashed email address, with Google and other analytics tool providers to facilitate the service. The analytics tools allow us to better understand how our users interact with our Services.  For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website, “How Google uses data when you use our partners’ sites or apps” located at www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Ad-On here: https://tools.google.com/dlpage/gaoptout/. 
• Financial information as needed to qualify for payment terms or to pay for subscription fees and other costs.
• Public Information about you in connection with other Personal Information we may have about you to personalize our Service for you and identify products and services that we believe may be of interest to you or your business.
• Audiovisual Information about you in connection with operating and managing any Site, Services, facilities or business operations, and hosting or managing any events that we may sponsor or be a participant.  
• Marketing Information about you to send you and personalize direct marketing communications based on your needs and interests.

We may use your personal information and disclose it to law enforcement, government authorities, and private parties to protect our legal interests, for any other legal purpose and as we believe necessary or appropriate to: (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Service;  (c) to comply with our legal and contractual obligations; and (d) protect, investigate and deter against security threats, fraudulent, harmful, unauthorized, unethical, malicious or illegal activity

We may create aggregated, de-identified and/or anonymized data from your Personal Information and other individuals whose Personal Information we collect.  We make Personal Information into de-identified and/or anonymized data by removing information that makes the data identifiable to you.  We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.  We will not attempt to re-identify any such data, except as permitted by law.

Additionally, in some cases, we may specifically ask for your consent to collect, use, or share your Personal Information, such as when required by law.

We do not sell your Personal Information to third parties. 

4.   What Personal Information Do We Disclose?

Kumo may disclose your Personal Information to the following third parties, and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection:

• With your consent:

  • To Kumo’s service providers who act on Kumo’s behalf and instructions to fulfill orders, deliver services, provide IT and customer support (including online chat functionality providers) and security services and fulfill the other purposes stated above.

• To other Kumo-owned business entities for the purposes of coordinating Service availability and development of products and services.

• To third-party advertising partners, for the targeted advertising practices, described below.

• To business and marketing partners such as third parties with whom we co-sponsor events or promotions, with whom we jointly offer products or services, or whose products or services may be of interest to you.

• As otherwise required by law or business practice: 

  • As required by applicable law, including, without limitation, in response to any government or regulatory agency request, to cooperate with law enforcement investigations, or upon receipt of any court order.

• To professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

• To business transferees (e.g., a prospective or actual purchaser or seller in the context of a merger, acquisition or other reorganization or sale of Kumo’s business or assets).  Kumo’s practice is to seek reasonable protection for information in these types of transactions.  

• To courts and public authorities to protect you, Kumo or third parties from harm, including fraud or instances where somebody’s physical safety is at risk.

Other information that we may collect which is not specifically listed here, but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

We may also provide public bulletin boards or forums on our Site or Service. Please note that any Personal Information you post via these bulletin boards or forums may be accessible to the public.  This information can be seen, collected, and used by others, including being cached, copied, screen captured, or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information.

Service providers acting on Kumo’s behalf are obliged to adhere to confidentiality requirements no less protective than those set forth herein and will only receive access to your Personal Information as necessary to perform their functions.

We also perform statistical analyses of the users of our Site or Service to improve the content, design and navigation of the Site and Service and our other products and services. In these cases, we use aggregate or statistical data that cannot reasonably be used to identify you.

5.  Sources of Personal Information.  

If Kumo does not obtain your Personal Information directly from you, Kumo may obtain it from the following sources: publicly available sources (such as public websites, public authorities, the internet or registers), Kumo’s employees or consultants or employers of our consultants, Kumo’s affiliates, subsidiaries or newly acquired entities, public authorities, educational institutions, suppliers and vendors, including any third-party data providers, and when you visit any Kumo offices.

6.   Your Choices

In this section, we describe the rights and choices available to all users.  Users who are located in California can find additional information about their rights below.

• Access or update your information. If you have registered an account, you may review and update certain account information by logging into the account or by contacting us. 

• Opt-out of communications. If you no longer wish to receive marketing-related communications, you may opt-out of receiving these emails by clicking “Unsubscribe” found in emails we send you.  Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.  

• Blocking images/clear gifs. Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings.

• Advertising choices. You may be able to limit use of your information for targeted advertising through the following settings/options/tools:

• Browser settings. Changing your internet web browser settings to block third-party cookies.

• Privacy browsers/plug-ins. Using privacy browsers and/or ad-blocking browser plug-ins that let you block tracking technologies. 

• Platform settings. Google and Facebook offer opt-out features that let you opt-out of use of your information for interest-based advertising. You may be able to exercise that option at the following websites:

  • Google: https://adssettings.google.com/ 

  • Facebook: https://www.facebook.com/about/ads 

• Ad industry tools. Opting out of interest-based ads from companies that participate in the following industry opt-out programs: 

• Network Advertising Initiative: http://www.networkadvertising.org/managing/opt_out.asp 

• Digital Advertising Alliance: optout.aboutads.info.   

• AppChoices mobile app, available at https://www.youradchoices.com/appchoices, which will allow you to opt-out of interest-based ads in mobile apps served by participating members of the Digital Advertising Alliance. 

• Mobile settings. Using your mobile device settings to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.

You will need to apply these opt-out settings on each device and browser from which you wish to limit the use of your information for interest-based advertising purposes.  

Declining to provide information. We need to collect Personal Information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.

7.  Third-Party Websites

Our Site or Service may include links to third-party applications, products, services, or websites.  If you access those links, you will leave our Site. Kumo does not control these third-party sites or their privacy practices, which may differ from Kumo’s practices. The Kumo Privacy Policy does not cover the Personal Information you choose to provide to or that is collected by these third parties. You are encouraged to review the privacy documentation of any third-party site you interact with before you allow them to collect and use your Personal Information.

Kumo may also provide social media features, such as the Facebook or Twitter buttons that enable you to share information with your social networks to interact with Kumo on various social media websites. Your use of these features may result in the collection or sharing of information about you depending on each specific social media website. This may include your IP address, which page you are visiting on our site, and a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our site. Your interactions with these features are governed by the privacy policy of the company providing it.

8.  Persons under the Age of 16

We do not knowingly collect personal information from minors under the age of 16. If we learn that we have collected the personal information of a minor under 16 years old, we will comply with applicable legal requirements to delete the information. If you believe that we might have any Personal Information from a child under age 16, please contact us at [email protected] 

9.   Cookies and Other Technologies

Kumo and our partners (e.g., marketing partners, analytics, advertising, or service providers) use various tracking technologies such as cookies, beacons, tags and scripts to analyze trends on our Site, to administer our Site and Service, and to gather demographic information about our user base as a whole. We receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis. 

Please see our Cookies Policy for more details including, information about your choices with respect to advertising and social media cookies and for access to our cookie consent manager.  Our website currently does not respond to “Do Not Track” signals from browsers. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.  

We also use chat technologies. and similar technology providers that employ cookies and software code to operate the chat features that you can use to communicate with us through the Site and Service.  Such third parties may access and use information about webpages visited on our Site, your IP address, your general geographic information (e.g., city, state), and other Personal Information you share through online chats for the purposes described in this Privacy Policy.

10.   Targeted Advertising Practices

We rely on a third-party services provider to either display advertising on our Site or to manage our advertising on other sites. These service providers may use technologies such as cookies to gather information about your activities on our Sites and other sites in order to provide you with advertising based upon your browsing activities and interests. If you wish to not have this information used for the purpose of serving you interest-based ads, you may opt-out by contacting us using the information stated below.

Please note this does not opt you out of being served ads. You will continue to receive generic ads.

11.  Protection of Personal Information

• Kumo takes a number of precautions — including administrative, technical, and physical measures — designed to safeguard your Personal Information against loss, theft, and misuse, as well as against unauthorized access, disclosure, alteration, and destruction.  Security is a shared responsibility.  Do not disclose your passwords and other authentication credentials to your account. Notify Kumo immediately of any suspected or known breach of security.  Security risk is inherent in all internet and information technologies, and we cannot  and does not guarantee the security of your Personal Information.

12.  Retention of Personal Information

We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy and our business agreement and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

13.   Access to Personal Information

As described above, you can help ensure that your contact information and preferences are accurate, complete, and up to date by contacting us using the information below. For other Personal Information, to the extent required by applicable data protection law, we make good faith efforts to provide you with access so you can request that we correct the data if it is inaccurate or delete the data if Kumo is not required to retain it by law or for legitimate business purposes. We will respond to your request within 30 days or sooner where required by law. As permitted by applicable law, we may decline to process requests where the data is required to be retained by law, required for legitimate business purposes, or jeopardizes the privacy of others.

14.   International Transfers. Agnostic Service.

Currently, our principal place of business is located in the United States. Your Personal information may be transferred to and processed in the United States and various other locations around the world both inside and outside of the European Economic Area (EEA) and Brazil, as needed to carry out the purposes described in this Privacy Policy and our business agreement, based on appropriate transfer mechanisms, including Standard Contractual Clauses and within the bounds set forth herein. The data protection laws in these countries may be different from, or less stringent than, those in your country of residence. These transfers are governed by the Supplemental European Privacy Statement and the Supplemental Brazilian General Data Protection Statement.

The Site and Service is not tailored to comply with industry-specific regulations, for example: Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA, etc.) so if your interactions would be subject to such laws, you may not use this Site.  You may not use the Site or Service in any way that would violate the Gramm-Leach Bliley Act (GLBA). 

15.   Privacy Policy Updates

Kumo may update its Privacy Policy from time to time to reflect changes to our information practices. When we change the policy in a material way, we will provide you with notice as required by applicable law, including notifying you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means.  We encourage you to periodically review this page for the latest information on our privacy practices.

16.  Contacting Us

If you have any questions about this Privacy Policy,  our privacy practices pertaining to the Site or  Services or your dealings with the Site including, for example, any inaccuracies or errors or materials that violate this Privacy Policy, errors or bugs or actual or potential threats to the security of the Site or service and protection of your Personal Information, please contact us at:

Kumo.ai, Inc.

357 Castro Street, Second Floor

Mountain View, CA 94041

Or via e-mail at [email protected]

CALIFORNIA PRIVACY RIGHTS STATEMENT

1. California Shine the Light Act. Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to request from a business with whom the California resident has an established business relationship, certain information with respect to the types of Personal Information the business shares with third parties for direct marketing purposes by such third party and the identities of the third parties with whom the business has shared such information during the immediately preceding calendar year. To request a copy of the information disclosure provided by us pursuant to Section 1798.83 of the California Civil Code, you must contact us at the e-mail or regular mail address specified in the Contact Us section below with “California Privacy Request” in the first line. Please note that under this law, we are not required to respond to your request more than once in a calendar year nor are we required to respond to any request that is not sent to the designated e-mail or mailing address.

2. California Do Not Track Disclosure. Do Not Track is a privacy preference that some users may set in their web browsers. When a user turns on the Do Not Track signal, the browser sends a message to Sites requesting them not to track the user. At this time, we do not recognize or respond to Do Not Track browser settings or signals and we will still receive information. As a result, we may still collect information about you and your internet activity, even if you have turned on the Do Not Track signal.

3. California Consumer Protection Act. Pursuant to the California Consumer Protection Act, the following additional disclosures and consumer rights, updated, on an annual basis, apply to California residents who access or use this Site:

   1. DISCLOSURES.

      1. Categories of Personal Information Collected: The categories of personal information we intend to collect in the following 12 months are described in Section 2 of the Privacy Notice.

2. Sources of the Personal Information Categories: The sources of personal information we intend to collect in the following 12 months are described in Section 3 of the Privacy Notice.
3. Purpose for the Collection of Personal Information: The purpose and legitimate basis for the collection of personal information by category in the following 12 months is set forth in this Privacy Notice.
4. Third-Parties With Whom We Share Your Personal Information. How we share Your personal is set forth in Section 5 of the Privacy Notice.

2. CALIFORNIA CONSUMER RIGHTS
   Subject to verification of your identity and other information that we may need to honor your request, all Californian consumers have the following rights:

   1. Right of Erasure. You have the right to request deletion of your personal information.

   2. Right to Opt-Out. We do not sell your personal information.

   3. Right to Know Whom We Sell or Disclosure Your Personal Information To. We do not sell your personal information.

   4. Right Against Consumer Discrimination. You have the right to not be discriminated against as a consumer by (a) denial of services, (b) paying more for services; and/or (c) receiving lesser quality services.

   5. Right to Access. You have the right to request access to or copies of the personal information you provided to us.

SUPPLEMENTAL EUROPEAN PRIVACY STATEMENT 

The information provided in this Supplemental European Privacy Statement applies only to individuals in the European Economic Area, United Kingdom, and Switzerland (collectively, “Europe”). If you are based in Europe, this Supplemental European Privacy Statement applies to you in addition to the Privacy Policy above.

References to “personal information” in this Privacy Policy should be understood to include references to “personal data” as defined by the “GDPR” (i.e., the General Data Protection Regulation 2016/679 (“EU GDPR”) and the EU GDPR as it forms part of UK law (“UK GDPR”). Under the GDPR, personal data is information about an individual, from which that individual is either directly identified or can be identified.  It does not include ‘anonymous data’ (i.e., information where the identity of the relevant individual has been permanently removed and that individual is no longer identified or identifiable).

Controller.  Kumo’s Customer is the controller in respect of the personal data covered by this Privacy Policy for purposes of the GDPR as Customer chooses whether to provide personal data to Kumo. 

Processor. Kumo.ai, Inc. is the processor in respect of the personal data covered by this Privacy Policy for the purposes of the GDPR. See ‘European Contacts’ for our contact details.

Cookies.  With respect to web cookies and other technologies that are not strictly necessary for our provision of the Services, Kumo seeks consent from users of the Service in Europe based on a separate Cookies Policy.

Legal Basis of Processing.

• In respect of each of the purposes for which we use your personal data, the GDPR requires us to ensure that we have a “legal basis” for that use. Our legal bases for processing your personal information described in this Privacy Policy are listed below.  Where we need to perform a contract, we are about to enter into or have entered into with you (“Contractual Necessity”).

• Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (“Legitimate Interests”). More detail about the specific legitimate interests pursued in respect of each Purpose we use your personal information for is set out in the table below.

• Where we need to comply with a legal or regulatory obligation (“Compliance with Law”).

• Where we have your specific consent to carry out the processing for the Purpose in question (“Consent”).  

We have set out below, in a table format, the legal bases we rely on in respect of the relevant Purposes for which we use your personal information – for more information on these Purposes and the data types involved, see Section 3, How Do We Use Your Personal Information.

 

Personal Data Transfers outside of Europe.  Kumo transmits some of your personal data to countries where the data protection laws may not provide a level of protection equivalent to the laws in your jurisdiction. All transfers of your personal data from Europe to a country that has not been deemed to provide an adequate level of protection will be based upon an adequacy decision or governed by appropriate safeguards in accordance with the GDPR (e.g., the European Commission’s Standard Contractual Clauses or the UK’s International Data Transfer Agreement).

Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law.  In the context of an onward transfer, Kumo has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf.  Kumo shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Data Retention. Kumo keeps personal data as long as required to provide our Services to you and comply with applicable laws. For example, if you register for an account on the Services, we retain your personal data for as long as you have an account with us and then for only as long as required for us to comply with applicable laws, discharge our contractual obligations to you or defend our legal interests in connection with any claim or defense we could face before any formal dispute resolution body. We take reasonable measures to ensure that personal data is deleted, erased or anonymized as soon as possible once the purposes for which personal data was collected have been fulfilled.

Data Subject Rights. European data protection laws give you certain rights regarding your personal data. If you are located in Europe, you may ask us to take the following actions in relation to your personal data that we hold:

• Access. Provide you with information about our processing of your personal data and give you access to your personal data.

• Correct. Update or correct inaccuracies in your personal data.

• Delete. Delete your personal data where there is no good reason for us continuing to process it - you also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below). 

• Transfer. Transfer a machine-readable copy of your personal data to you or a third party of your choice.

• Restrict. Restrict the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.

• Object. Object to our processing of your personal data where we are relying on Legitimate Interests – you also have the right to object where we are processing your personal data for direct marketing purposes.

• Withdraw Consent. When we use your personal data based on your consent, you have the right to withdraw that consent at any time.  

You can exercise such rights by accessing the information in your account or by submitting a request via email to [email protected]. Please note that these rights may be subject to limitations and conditions under the GDPR or applicable national data protection laws.

Your Right to Complain. In addition to your rights outlined above, if you are not satisfied with our response to a request you make, or how we process your personal data, you can make a complaint to the data protection regulator in your habitual place of residence. 

• For users in the European Economic Area – the contact information for the data protection regulator in your place of residence can be found here: https://edpb.europa.eu/about-edpb/board/members_en
• For users in the UK – the contact information for the UK data protection regulator is below:

The Information Commissioner’s Office
Water Lane, Wycliffe House
Wilmslow - Cheshire SK9 5AF
Tel. +44 303 123 1113
Website: https://ico.org.uk/make-a-complaint/

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Kumo commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

Your Choices. You are not required to provide any personal data to Kumo, but if you do not provide any personal data to Kumo, you may not be able to use our Services or conduct business with us effectively. You can use our Services without consenting to cookies that are not strictly necessary; the only consequence is that our Services will be less tailored to you.

Profiling. Kumo does not use in connection with our Services automated decision-making in a way that produces legal effects concerning you or which significantly affects you.

Data Privacy Framework Participation

Kumo complies with the complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-US. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Kumo has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.  Kumo has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

U.S. Federal Trade Commission (FTC)

The Federal Trade Commission has jurisdiction over Kumo’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

Complaints 

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Kumo commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Kumo at: [email protected] 

Kumo is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to Kumo and following the procedures and subject to conditions set forth in Annex I of Principles.

SUPPLEMENTAL BRAZILIAN GENERAL DATA PROTECTION STATEMENT

This section is incorporated into and supplements the foregoing Privacy Policy applying to all Users in Brazil (Users are referred to below, simply as “you”, “your”, “yours”), according to the "Lei Geral de Proteção de Dados" (the "LGPD"), and for such Users, it supersedes any other possibly divergent or conflicting information contained in this Privacy Policy.
This part of the document uses the term “personal information“ and “users” as it is defined in the LGPD.

The grounds on which we process your personal information

We can process your personal information solely if we have a legal basis for such processing. Legal bases are as follows:

• your consent to the relevant processing activities;

• compliance with a legal or regulatory obligation that lies with us;

• the carrying out of public policies provided in laws or regulations or based on contracts, agreements and similar legal instruments;

• studies conducted by research entities, preferably carried out on anonymized personal information;

• the carrying out of a contract and its preliminary procedures, in cases where you are a party to said contract;

• the exercising of our rights in judicial, administrative or arbitration procedures;

• protection or physical safety of yourself or a third party;

• the protection of health – in procedures carried out by health entities or professionals;

• our legitimate interests, provided that your fundamental rights and liberties do not prevail over such interests; and

• credit protection.

To find out more about the legal bases, you can contact us at any time using the contact details provided in Section 16, Contacting Us.

Categories of personal information processed

To find out what categories of your personal information are processed, you can read Section 2, What Personal Information Do We Collect, and Legal Basis of Processing in the SUPPLEMENTAL EUROPEAN PRIVACY STATEMENT.

Why we process your personal information

To find out why we process your personal information, you can read Section 3, How Do We Use Your Personal Information and the Legal Basis of Processing in the SUPPLEMENTAL EUROPEAN PRIVACY STATEMENT.

How to file a request and our response to your requests

You have the right to:

• obtain confirmation of the existence of processing activities on your personal information;

• access to your personal information;

• have incomplete, inaccurate or outdated personal information rectified;

• obtain the anonymization, blocking or elimination of your unnecessary or excessive personal information, or of information that is not being processed in compliance with the LGPD;

• obtain information on the possibility to provide or deny your consent and the consequences thereof;

• obtain information about the third parties with whom we share your personal information;

• obtain, upon your express request, the portability of your personal information (except for anonymized information) to another service or product provider, provided that our commercial and industrial secrets are safeguarded;

• obtain the deletion of your personal information being processed if the processing was based upon your consent, unless one or more exceptions provided for in art. 16 of the LGPD apply;

• revoke your consent at any time;

• lodge a complaint related to your personal information with the ANPD (the National Data Protection Authority) or with consumer protection bodies;

• oppose a processing activity in cases where the processing is not carried out in compliance with the provisions of the law;

• request clear and adequate information regarding the criteria and procedures used for an automated decision; and

• request the review of decisions made solely on the basis of the automated processing of your personal information, which affect your interests. These include decisions to define your personal, professional, consumer and credit profile, or aspects of your personality.

You will never be discriminated against, or otherwise suffer any sort of detriment, if you exercise your rights.

How to file your request

You can file your express request to exercise your rights free from any charge, at any time, by using the contact stated in Section 16, Contacting Us.

How and when we will respond to your request

We will strive to promptly respond to your requests.  In any case, should it be impossible for us to do so, we’ll make sure to communicate to you the factual or legal reasons that prevent us from immediately, or otherwise ever, complying with your requests. 

In cases where we are not processing your personal information, we will indicate to you the physical or legal person to whom you should address your requests, if we are in the position to do so.  

In the event that you file an access or personal information processing confirmation request, please make sure that you specify whether you’d like your personal information to be delivered in electronic or printed form.

You will also need to let us know whether you want us to answer your request immediately, in which case we will answer in a simplified fashion, or if you need a complete disclosure instead.  In the latter case, we’ll respond within 15 days from the time of your request, providing you with all the information on the origin of your personal information, confirmation on whether or not records exist, any criteria used for the processing and the purposes of the processing, while safeguarding our commercial and industrial secrets.

In the event that you file a rectification, deletion, anonymization or personal information blocking request, we will make sure to immediately communicate your request to other parties with whom we have shared your personal information in order to enable such third parties to also comply with your request — except in cases where such communication is proven impossible or involves disproportionate effort on our side.

Transfer of personal information outside of Brazil permitted by the law

We are allowed to transfer your personal information outside of the Brazilian territory in the following cases:

• when the transfer is necessary for international legal cooperation between public intelligence, investigation and prosecution bodies, according to the legal means provided by the international law;

• when the transfer is necessary to protect your life or physical security or those of a third party;

• when the transfer is authorized by the ANPD;

• when the transfer results from a commitment undertaken in an international cooperation agreement;

• when the transfer is necessary for the execution of a public policy or legal attribution of public service;

• when the transfer is necessary for compliance with a legal or regulatory obligation, the carrying out of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.