# Privacy **Introduction** This Privacy Policy explains how Replicated collects, uses and shares Personal Data in compliance with: - General Data Protection Regulation (GDPR (EU & UK) - California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) - Other applicable U.S. and international data privacy laws. Replicated is committed to data security and transparency as a provider of enterprise SaaS Solutions. Your privacy is important to us. **Personal Data** as used in this Privacy Policy will have the meaning given to it under relevant data protection laws. The term "Personal Data" includes "personal information," "personally identifiable information," and equivalent terms as such terms may be defined by the relevant data protection laws. This privacy policy (“**Privacy Policy**”) describes our sources of collection of Personal Data, why we collect the information, what Personal Data we collect, how we collect it, and how we use and share it, as well as your options to opt out of collection or to control your Personal Data. We also share how we protect your Personal Data. **Replicated as a Controller vs. Processor** Replicated acts as either a Data Controller or Data Processor depending on the context of data processing. As a Controller, Replicated determines the purpose and means of processing Personal Data for: - Account Setup, authentication, and security - Billing and service related communications - Marketing, analytics, and legal compliance As a Processor, Replicated processes Personal Data only on behalf of its enterprise customers under the Master Terms and Conditions and/or a Data Processing Agreement. When acting as a processor, Replicated does not control the data but secures and processes under the terms of the Agreement with the Customer. **Sources of Collection** Replicated collects Personal Data across a number of channels, including our websites, newsletters, events, webinars, your purchases, and support of the Replicated products and services. Information may be collected from you directly, from third party partners or customers of Replicated products and services, as well as cookies, analytics, and logs. Replicated may derive aggregated or anonymous data from data collected through these means, including Replicated products and services. **How we protect your Personal Data** We take commercially reasonable measures, including physical, administrative and technical safeguards, to protect your Personal Data from unauthorized access, use, alteration, destruction, and disclosure. Despite our taking reasonable security precautions and processes, no data transmission over the Internet can be guaranteed to be 100% secure. If you have reason to believe that your Personal Data may no longer be secure, please notify us immediately at privacy@replicated.com. **Fair and Lawful Basis** Replicated will only process Personal Data when we have a fair and lawful basis for the activity, including: - where you have given your **consent**, which you may revoke at any time with effect for the future; - as necessary to **fulfill or perform a contract**; - when we have a **legal obligation**; - the processing is necessary **to further our legitimate interests**. **Why We Collect and How We Use Your Personal Data** Replicated collects and uses your Personal Data for the following purposes: **Deliver products and services, improve products and provide customer support** - Facilitate the evaluation, purchase and delivery of Replicated products and services - Enable access to products and services, support your use, and provide technical support **Improve Products and Services and Internal operations** - Analyze usage data to drive improvements **Marketing, events, and promotions** - Deliver information about our company and products and services **Fraud prevention, security, and compliance** - Protect the security and integrity of Replicated products and services and data ### **What do we collect?** We automatically collect information when you visit our websites or use our products and services. The data we collect includes: - **Log data (including browser, location, and device information)** - **IP addresses** - **Cookies** **Newsletters, Blogs, Webinars, and Events** Replicated may collect: - **Email addresses** - **IP addresses and location data** - **Subscriber activity** **Purchasing Products and Services; Account setup and Billing** Account setup requires providing several pieces of information including: - **Company name** - **Names and Email addresses** - **Phone Numbers** - **Company Address** - **Passwords** - **Billing Data** **Cookies; Cookie policy** Replicated uses Cookies to: - Operate a secure website - Collect website usage statistics **Types of Cookies**: - **Strictly Necessary** - **Functionality** - **Performance** - **Targeting** **Analytics services** Replicated uses Google Analytics to improve our websites. **When we share your Personal Data and the Purposes for which we may share** Replicated may engage sub-processors to Process your Personal Data. **Delivery of Products and Services**. We may share Personal Data with third-party service providers who help us market, provide support, maintain or service Replicated products. **Product Development and Security Practices**. Replicated follows software development best practices and engages in security and privacy training. **Legal Requirements**. We may disclose your Personal Data to comply with applicable laws and fulfill our legal obligations. **Marketing communications from Replicated** Replicated may communicate marketing materials or customized content relevant to you. You may unsubscribe from receiving these communications. **Service-related communications from Replicated** Replicated may send service-related communications necessary for the use of your products and services. **How long we store your Personal Data** We retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Policy. **Your Personal Data rights** Residents have the right to access, rectify, and delete Personal Data under certain conditions and may contact Replicated’s Privacy Office for assistance at privacy@replicated.com. ### **Withdrawing Your Consent** You may withdraw your consent for Replicated to process your Personal Data by notifying Replicated's Privacy Office. **AI, Automated Processing and Profiling**. Replicated may use automated decision-making technologies. Residents of EEA/JK have the right to object to automated processing. **Additional disclosures for California residents** - Right to Know - Right to Delete - Right to Correct Inaccurate Personal Data - Right to Opt-Out of the Sale or Sharing of Personal Data **Exercising Your California Law Rights** Requests may be made by emailing privacy@replicated.com. **Changes** Replicated may update this policy and will notify you about significant changes. This privacy policy was last updated June 19, 2025. **Questions** For questions about this Privacy Policy or our collection and use of your Personal Data, please contact privacy@replicated.com.