Legal Center

Privacy Notice/Policy

version 1/2024, Effective 24 September 2024

1. Introduction

This Privacy Notice/Policy (“Privacy Notice”) describes practices of Mirantis, Inc., (“Mirantis” or “we”) regarding collection and further processing of information related to identified or identifiable individuals (“personal information”).

This Privacy Notice is applicable in the cases when Mirantis decides about the purposes and means of processing (when Mirantis is a data controller). It does not apply in the situations when we are only engaged in processing by a third party that determines the purpose and means of processing. This Privacy Notice does not apply to processing of personal information of job applicants or employees of Mirantis, for more details about this processing, please see the applicable policy available here. This Privacy Notice is applicable in particular to the personal information:

• related to visitors of Mirantis websites;
• processed for marketing purposes of Mirantis;
• processed in connection with provision of services by Mirantis to you or your company (to the extent in which Mirantis acts as a data controller);
• related to visitors of Mirantis offices;
• related to product telemetry; and
• related to the protection of Mirantis commercial rights.

For more information about collection and processing of personal information in the course of specific activities, please see the relevant sections of this Privacy Notice.

If you are a resident of California or other U.S. state, a member state of the European Economic Area (EEA) or of the United Kingdom, you have certain special rights granted by local regulations applicable in these regions. Please see the sections addressed to the U.S., EEA or UK residents for more information.

2. Processing Activities Related to Mirantis Websites

Mirantis websites collect personal information at several points and for various purposes, which can include processes associated with e-commerce, product or service registration, account creation, e-mail opt-in or collection of additional information about your use of Mirantis websites such as cookies or similar technology. The source of personal information that we collect about you on Mirantis websites is you or the person providing your personal information through our websites on behalf of you.

The following personal information is collected and processed in connection with your activities on our websites:

Purposes. The personal information collected through the forms on our website is processed for the purpose related to the specific form through which you registered. For example, if you register through the registration form for Mirantis training, we will process your personal information for the purpose of providing you with this training. If you create a user account on our website, we will process your personal information in order to keep this account for you. In some countries, we are allowed to and we process your personal information also for other purposes compatible with the purpose for which you provided us with the personal information, such as offering of similar services as those for which you already registered. We may use the collected personal information also for other legitimate purposes such as ensuring security of our websites, responding to your requests or otherwise contacting you, processing your payments, organizing events and planning other activities or campaigns, or improving our services.

Legal Basis.When you register through a form by which a contract is established between you and Mirantis, our legal basis for the processing of your personal information is entering into the contract with you, performance of our contractual obligations and communication with you during the contractual relationship. If you submit your personal information through other forms on our website(s) (by which a contract is not entered into), for example if you register for our newsletters or create an account, our basis for processing will be our legitimate interest in providing you with the functionality or content based on the respective registration.

Cookies. Our websites also use cookies and similar tracking technologies. For more information about our use of these technologies, please see here.

Third Party Sites. We offer links to other websites (“Third Party Sites”). Please note that Third Party Sites may observe privacy standards different from ours and the collection and use of your personal information will be governed by the privacy policies of such Third Party Sites. Our websites offer a space for postings and submissions. Please be advised that any information posted in these venues will be publicly available.

3. Processing Activities for Marketing

Mirantis, as other companies, collects and processes personal information for marketing purposes or other activities related to sale of Mirantis products or services or promotion of Mirantis brand. The sources from which we collect personal information for these purposes might be you or your company, generally available websites where information about you are published in connection with your current or past business position, or third-party providers of business contacts lists. This applies as long as the collection and processing is compliant with the applicable data privacy laws.

For marketing purposes, we collect and process in particular the following categories of personal information with which additional information about you may be associated:

Purpose and Legal Basis. Personal information collected for the purpose of marketing activities of Mirantis is processed based on our legitimate interests, in particular for marketing activities including offering of our products or services to relevant persons or promotion of Mirantis brand, to the extent that such legitimate interest does not conflict with the applicable data privacy laws or your prevailing rights and interests.

Opting-out of Marketing. You can opt-out of marketing communications by following the unsubscribe instructions in any received communication or by using one of the designated contacts in section 13. You may not opt-out of legal notices, service-related or transactional communications, which are not marketing.

4. Processing Activities in Connection with the Provision of Services by Mirantis

If you or your company enter into an agreement with Mirantis for use of products or services offered by Mirantis, we may collect and process certain personal information about you that is provided either by you or by your company. This personal information may include especially the following categories and types of personal information with which additional information about you may be associated:

Purposes and Legal Basis. The above listed personal information is collected and processed to provide you or your company with the ordered products or services, to contact you or your company or have you or your company registered as a customer or customer’s designated representative for the purchased products or services and for interactions in the course of the customer relationship. This includes activities such as providing support, paying invoices, and communicating product changes. Our legal basis for processing is the performance of our contractual obligations towards you (if you are our customer) or our legitimate interest in providing the service towards your company (if your company is our customer).

Personal information listed above might be processed also for additional purposes compatible with the initial purpose such as for improvements of our product or services, in such a case the legal basis is our legitimate interest, always to the extent such processing does not conflict with the applicable data privacy laws or your prevailing rights and interests.

Please note, that in the course of providing services, Mirantis may process certain personal information on behalf of its customers that might be the controllers of your personal information. In such a case the details about the processing have to be provided by such controllers and not by Mirantis.

5. Processing Activities Related to Your Visit of Mirantis Office

If you visit Mirantis premises, some personal information might be collected about you and processed for the purpose of our visitor management, protection of our property and compliance with certain security standards. This personal information includes:

Purposes and Legal Basis. The above listed personal information is processed primarily to manage your visit, ensure the security of our premises, and to comply with our security protocols. Additionally, this information may be used to provide products or services to you or your company, facilitate contact with you or your company, or register you or your company as a customer or designated representative in connection with purchased products or services, and for interactions in the course of the customer relationship. Our legal basis for processing is the performance of our contractual obligations towards you (if you are our customer) or our legitimate interest in providing the service towards your company (if your company is our customer), and in both cases managing our business relationship with you or your employer, and maintaining the security of our premises .

Personal information listed above might be processed also for additional purposes compatible with this initial purpose such as for improvements of our product or services, in such a case the legal basis is our legitimate interest, always to the extent that such processing does not conflict with the applicable data privacy laws or your prevailing rights and interests.

1. Processing Activities related to Product Telemetry

Some of our products have a telemetry function that may collect the information about you and your use of the software and send this information to Mirantis. This personal information includes:

Purposes and Legal Basis. You may decide whether you agree with the collection of some telemetry data and its provision to Mirantis by using the software with the telemetry function turned on or off. The purpose of collection of this information collected from users is further optimization and improvement of the software and services. When the optional telemetry is turned off, the software will still provide Mirantis only with personal information that is strictly necessary to provide the selected services, including updates or upgrades of the software, and to prevent unauthorized use of software post-license expiration. You may manually opt-out from automatic software updates and upgrades. In the last two scenarios, Mirantis relies on legitimate interests of providing selected services, including updated and upgraded software, and of enforcing payment by identifying and reaching out to organizations and individuals using our software without valid licenses.

If you use our software product as a member of an organization (e.g. as an employee of a company for which you work), the decision about the telemetry usage is upon such organization. Please consult the settings of telemetry with your organization.

7. Processing Activities Related to the Protection of Mirantis Commercial Rights

Lens. When we reasonably suspect that you may be eligible for an enterprise plan rather than a personal plan based on your company's criteria we may share your personal information (email, and when requested name and LensID) with your company/employer procurement team. Our legitimate interest for sharing your personal information is based on our commitment to engaging in lawful and ethical business practices, ensuring the enforcement of our terms and conditions, preventing fraud and fostering potential partnerships with enterprises that are interested in using our software. We deem that the means used are proportionate and necessary to achieve the intended legitimate business purpose. This information will be handled securely by both parties, in particular to ensure protection against unauthorized access. When personal information is transferred outside of EEA this is based on the exception in Article 49 of the GDPR, specifically for the establishment, exercise, or defense of legal claims.

We also refer to section 6 regarding the telemetry settings.

8. Third Party Recipients of Personal Information

Tech businesses often use third parties to help them host their application, communicate with customers, power their emails etc. We partner with third parties who we believe are the best in their field at what they do. When we do this, sometimes it is necessary for us to share your personal information with them in order to get these services to work well.

If you sign up to attend one of our events, we may share your name, work details and contact information with organizers of that event for organizational purposes.

We use a third party analytical software to gather statistical information about our website visitors, in particular to enhance the quality of our website.

When you purchase through Mirantis webstore, third-party providers will be authorized to process your payment information to enable the purchase. The third-party processors responsible for your payments, will have access to your personal information instead of us.

Your personal information may be also shared with third party recipients for the purpose of corporate and operational governance, which include:

• The affiliated companies of Mirantis which are involved by Mirantis in certain joint activities, see the list of Mirantis affiliates here;
• third parties providing advisory services to Mirantis, such as our financial, legal or other advisors;
• third parties that might have legitimate interest in knowing your personal information in case of merger, acquisition, reorganizations, sale of part of our business or other corporate change of Mirantis.

Your personal information is shared with third parties only when necessary, for our legitimate purposes as specified above, and according to the safeguards and good practices detailed in this Privacy Notice.

9. Security and Retention of Personal Information

We use industry-standard methods of securing electronic databases with personal information. We limit access to personal information in electronic databases to those persons in our organization who have a legitimate business need or other lawful basis for such access.

Your privacy is very important to us. However, due to factors beyond our control, we cannot fully ensure that your personal information will not be disclosed to third parties other than those mentioned above. For example, we may be legally required to disclose information to the government or third parties under certain circumstances, or third parties may unlawfully intercept or access transmissions or private communications. No organization, including Mirantis, can fully eliminate security risks associated with personal information.

We retain the personal information of individuals for a commercially reasonable time. The length of storage depends on the period required by the applicable laws (if any) and on the purpose for which the data was collected. For example, if you create an account at Mirantis website, we will process your personal information until you request deletion of the account or until the account is otherwise deactivated. For more details about the retention periods in specific cases when your personal information is processed, please contact us on one of the designated contacts in section 13.

10. EEA and UK Residents – Additional Information

The following section is designed for individuals whose personal information is protected by the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or the UK Data Protection Act 2018 and the UK General Data Protection Regulation (“UK GDPR”).

Processing outside the EEA and UK. Mirantis is a company headquartered in the United States and some of the third parties with which the personal information may be shared (as per section 8) operate in countries outside the European Economic Area (EEA) and UK. For this reason, your personal information will be processed also in countries that are not subject to an adequacy decision of the European Commission. When we export personal information to such countries, we rely on one or more of the available legal instruments such as EU Standard Contractual Clauses or EU-U.S. Data Privacy Framework certification guaranteed by the company to which the personal information is exported in order to ensure adequate level of protection for your personal information. For more details about the safeguards in specific cases, please contact us on one of the designated contacts in section 13.

Your Rights. When GDPR or UK GDPR is applicable, you, as a data subject, have certain rights. You have the right to:

• Right of Access: request access to your personal information processed by us and obtain a copy of your data
• Right to Rectification: request correction of inaccurate personal information and the completion of incomplete data
• Right to Erasure/Right to be Forgotten: request the deletion of your personal information in cases specified by the applicable law, such as when data is no longer necessary for the purposes for which it was collected
• Right to Restriction of Processing: request the restriction of processing in cases specified by the applicable law, such as when you contest the accuracy of your personal information or object to its processing
• Right to Data Portability: receive your personal information in a structured, commonly used, and machine-readable format and have the right to transfer that data to another entity without hindrance, where technically feasible
• Right to Object: object to processing of your personal information based on legitimate interests, including profiling, and automated decision-making, as well as to processing for direct marketing purposes

If you wish to exercise any of your rights, please use one of the designated contacts in section 13. We will respond to your request without undue delay, and no later than within 30 days. In some cases, we may extend this period by additional two months, and we will inform you of the reason for the delay.

Please note that your rights are not absolute and may be subject to certain exceptions under applicable law. For example:

• The rights of access, rectification, and data portability must be balanced against the rights and freedoms of others, such as another person’s confidentiality or intellectual property rights.
• The right to object to processing based on legitimate interests may be refused if we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

We will provide a detailed explanation if any of your rights are restricted upon receiving your request.

You also have the right to lodge a complaint with the relevant data protection authority if you believe that your rights have been violated. Please tell us first, so we have a chance to address your concerns.

11. U.S. Residents – Additional Information

This section provides residents of the United States with additional information about the collection and use of their personal information and their rights under state privacy laws (where applicable), including the California (CCPA and CPRA), Virginia (VCDPA), Texas, Washington, Colorado (CPA), Vermont, and Nevada privacy laws.

Your Rights. When U.S. state laws are applicable, you, as a resident of applicable states, have certain rights regarding your personal information. You have the right to:

• Right to Know/Access: request the information about the categories of personal information we collected about you, the categories of sources from which the personal information was collected, the business or commercial purpose for collecting or selling personal information, the categories of third parties with whom we shares personal information and the specific pieces of personal information we have collected about you
• Right to Delete: request the deletion of your personal information that we have collected from you, subject to certain exceptions, (such as when the information is necessary to complete a transaction, detect security incidents, comply with legal obligations)
• Right to Correct: request the correction of inaccurate personal information that we maintain about you
• Right to Non-Discrimination: not to receive discriminatory treatment for exercising any of your privacy rights, including equal services and prices
• Right to Limit Use of Sensitive Personal Information: limit the use and disclosure of your sensitive personal information for purposes beyond those necessary to provide goods or services

If you wish to exercise any of your rights, please, use one of the designated contacts in section 13, we will respond without undue delay, in accordance with applicable state privacy law.

Information about Sale of Personal Information. Mirantis does not sell your personal information as defined under CCPA and CPRA. You have the right to opt out of the sale or sharing of your personal information. Although we do not sell your personal information, you may still exercise this right as a precautionary measure.

Even though we don’t sell consumer data, under California’s “Shine the Light” law California Civil Code § 1798.83 California residents, and under Nevada law, Nevada residents may still request and obtain from us, once a year, free of charge, a list of third parties, if any, to which we disclosed their personal information for direct marketing purposes during the preceding calendar year and the categories of personal information shared with those third parties. If you are a California or Nevada resident and wish to obtain that information, please submit your request through one of the designated contacts in section 13.

12. Use by Persons Under 16 Years of Age

We do not knowingly seek to collect personal information from users under the age of 16 nor are they intended to be used by anyone under 16. If you are under the age of 16, you are not permitted to use our services or the Mirantis website, or to disclose Personal Information using them. If we learn we have collected or received Personal Information from a child under 16, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us through one of the designated contacts in section 13.

13. Contact Information

The controller of personal information is Mirantis, Inc., a Delaware corporation with a registered seat at 900 E. Hamilton Avenue, Suite 650, Campbell, CA 95008, USA. Mirantis has appointed a data protection officer (“DPO”) which is available on the email address below.

Designated methods for contacting Mirantis, Inc. in matters related to your privacy:

• Email: dataprivacy(at)mirantis.com

(please use this email to contact Mirantis DPO).

• Toll-free telephone number: +1-650-963-9828
• Address: Attn. Legal, 900 Hamilton Blvd, Suite 650 Campbell, CA 95008, USA

(California HQ office)

Please note that exercise of your rights through these designed contacts may be subject to further verification of your identity.

14. Future Modifications

We may amend this Privacy Notice from time to time. If we make significant changes, we will notify you by posting a prominent notice on our websites, and where possible, we may also notify you directly via email or other communication channels. Your continued use of our website or services and processing of personal information after any amendments will be subject to an updated Privacy Notice.

List of major changes in this revision of the Privacy Notice:

• Added processing related to Mirantis commercial rights, in particular related to enforcement of Mirantis license rights
• Updated processing activities related to product telemetry and visits to Mirantis offices
• Highlighted the right to opt out of direct marketing
• Updated the list of categories of third party recipients of personal data
• Expanded the list of EEA and UK residents privacy rights, and added clarifications about the data subject requests process
• Expanded the scope of additional information section to all U.S. states, in particular those that enacted privacy laws, and added more information regarding the sale of personal information
• Added information about users under 16 years of age
• Updated information about the process for updating the Privacy Notice