Smartsheet Content and Promotion Privacy Notice

Smartsheet Inc. and its affiliated companies (a full list is available here) (collectively referred to as “Smartsheet”, "we", "us" or "our" in this privacy notice) are joint controllers of your personal data. 

 

1.    INTRODUCTION 

This privacy notice ("Notice") aims to give you information on how Smartsheet will collect and process the following categories of personal data about you in order to promote Smartsheet products, services, and events in accordance with the agreement between us and you or the organization or other legal entity with whom you have a relationship (e.g., employer/employee) (“Participant”):

• your biography;
• your photograph;
• recordings;
• voice;
• likeness;
• your name, username, and professional and organizational profile information, such as title, department, company name, and company size and revenue; and
• contact details, such as your company address, email address, and contact telephone number.

This Notice only relates to how Smartsheet will process the above listed personal data further to your agreement to participate in the initiatives agreed to in the agreement between Smartsheet and Participant for the promotion of Smartsheet products, services, events, or Participant’s participation in an Activity (as defined below), or any other lawful business purpose. 

This Notice does NOT apply to Smartsheet's websites and offerings that display or link to different privacy notices or that are operated by companies other than Smartsheet, nor to business activities or practices of third parties, including but not limited to, applications and platforms used for live-streaming, recording, or displaying the materials or our customers, each of which may have their own terms and conditions and privacy notices.

It is important that you read this Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you (e.g., if you are using our website) so that you are fully aware of how and why we are using your data. This Notice supplements the other notices and is not intended to override them.

 

2.    WHO WE ARE

Smartsheet Inc. is headquartered in Washington state, with various other offices in the United States. You can learn about us and our Offerings here and view a full list of our affiliated companies here. 

How to Contact Us

If you have any questions about this Notice, including any requests to exercise your privacy rights, you may contact our privacy contact, at:

• Webform: Contact Privacy Form
• Email: privacy@smartsheet.com

You have the right to complain to a data protection authority about our collection and use of your personal data, but we encourage you to reach out to us first using the details set out above. The best way to reach us is by emailing privacy@smartsheet.com.

 

3.    YOUR DUTY TO INFORM US OF CHANGES

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

 

4.    THE DATA WE HAVE COLLECTED AND HOW IT WAS OBTAINED

We may collect the personal data listed (see ‘Introduction,’ above) from:

• a Participant; and/or 
• publicly available data; and/or
• directly from you when you interact with Smartsheet personnel for customer use cases; written case studies; video case studies; press releases; testimonial summaries; participate in press/analyst interviews; act as a reference for Smartsheet customers; participate or present at a webinar and in-person user groups; and/or act as a speaker at a Smartsheet hosted or sponsored event (each an “Activity”).

 

5.    PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. We will use your personal data in the following circumstances:

• on the basis of your consent, which is provided by attending an Activity; 
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (see ‘Glossary’ for more information on the meaning of legitimate interests); and
• where we need to comply with a legal or regulatory obligation.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are. 

Note that we may process your personal data on more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Personal Data Processed:
●    Name; ●    Biography; ●    Photograph; ●    Recordings; ●    Voice; ●    Likeness; ●    Professional and organizational profile information, such as title, department, company name, and company size/revenue; and  ●    Contact details, such as your company address, email address, and contact telephone number.
Purpose of processing your data	Lawful basis for processing including basis of legitimate interest (if applicable)
Contacting you to discuss, solicit, and provide information and provide resources for the Activity.	Consent
Sharing your contact details and professional and organizational profile information in connection with the Activity.	Consent
Sharing information provided in connection with the Activity with third parties who provide services to Smartsheet including content design, creative support, video production, and promotional marketing; Smartsheet event operations and marketing; Smartsheet’s channel partners; and infrastructure processors.	Consent
Record audio and visual recordings, including live streaming, to produce content in connection with an Activity.	Consent
For use in Smartsheet’s sales and marketing materials including presentations, demonstrations, user/focus groups, and webinars; Smartsheet’s marketing emails; and releases issued to press and media for the promotion of Smartsheet products, services, and events.	Consent
For use on Smartsheet owned or controlled websites and platforms and on any social media website account controlled by Smartsheet or by a Smartsheet employee acting within their employment with Smartsheet to promote Smartsheet products, services, and events.	Consent
For research and/or analytical purposes to evaluate and improve Smartsheet products, services, and events.	Consent
Contacting you in the event Smartsheet wishes to use the materials created in connection with an Activity for any other purposes other than those listed.	Consent
Managing our relationship with you, including notifying you of changes to our privacy policy; storing your contact details so we can contact you; and keeping a record of your consent.	• Necessary for our legitimate interests (to maintain a record of your contact details in case we need to further contact you in relation to the Activity; to keep our records updated). • Necessary to comply with a legal obligation.

 

6.    HOW WE SHARE PERSONAL DATA

We will not sell your personal data to a third party or allow a third party to use personal data we provide for its own marketing purposes. We may share information about you with your consent, at your request, as otherwise permitted under applicable data protection law, or as follows: 

To Our Service Providers. We use third party service providers to process your personal data to assist us with production, management, content design, creative support, video production, promotional marketing, and Smartsheet event operations and marketing, or other services related to the Activities. Smartsheet has data processing agreements with such service providers limiting their use of and access to personal data to such purposes. 

To Our Channel Partners. We may share your personal data, customer use case, written case studies, video case studies, press releases, and testimonial summaries with Smartsheet’s authorized channel partners in connection with the promotion of Smartsheet products, services, and events. Smartsheet has data processing agreements with such channel partners limiting their use of and access to personal data to such purposes. 

To Social Media Platforms.  We use third party platforms to support audio and visual recording, including live-streaming. Photographs and/or audio-visual footage may be taken and/or live-streamed during an event. Photos and videos can be published on Smartsheet websites and social media pages as well as on channel partners’ online platforms. Photos and videos may also be recorded and can be reproduced in various media including publications, social networks, and press, in connection with a specific event, or for further institutional purposes as well as for promotional activities of Smartsheet.

To Publishing and Analyst Firms. We may share your personal data, customer use case, written case studies, video case studies, press releases, and testimonial summaries with publishing and analyst firms who may contact you for an interview about your customer experience with your use of Smartsheet technologies. 

To Infrastructure Processors. We use third parties for some of the infrastructure used to host content and personal data we process, including cloud providers. Smartsheet has data processing agreements with such service providers and their use of and access to personal data is limited to specific purposes.

As Required by Law. We release information about you if we believe we must do so to comply with the law or a subpoena, bankruptcy proceeding, or similar legal process. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

To Protect Rights. We may disclose information about you, such as your name and contact information, to enforce our agreements with you or to protect the rights and safety of Smartsheet, our customers, our users, and the general public, or as evidence in litigation in which we are involved.

As Aggregate and Anonymized Information. We may share aggregate or anonymized information about you with our third-party service providers for our internal business purposes which may include marketing, advertising, research, or similar purposes. 

In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred to the acquiring entity as part of the transaction (provided that we inform the buyer it must use your personal data only for the purposes disclosed in this notice), and may also be reviewed as part of the due diligence review for the transaction.

 

7.    YOUR LEGAL RIGHTS

You have, in connection with your personal data, under certain circumstances, the right to: 

Access. You can ask us to confirm we are processing your personal data, provide you with details about such processing, and give you a copy of your personal data.

Erasure. You can ask us to erase your personal data if certain conditions are met. We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims. 

Objection. You can object to any processing of your personal data, which is done on the basis of our 'legitimate interests,' if you believe your fundamental rights and freedoms outweigh our legitimate interests. Once you have objected, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. In addition, you can object to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. We will then cease the processing of your personal data for direct marketing purposes.

Portability. You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another data controller, but only where our processing is based on your consent and the processing is carried out by automated means.

Rectification. You can ask us to correct information; we may verify the accuracy of the information before rectifying it.

Restriction. You can ask us to restrict (i.e., keep but not use) your personal data, but only where: its accuracy is contested (see 'Rectification,' above), to allow us to verify its accuracy; the processing is unlawful, but you do not want it erased; it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise, or defend legal claims; and you have exercised the right to object, and verification of any overriding grounds is pending. We can continue to use your personal data following a request for restriction where we have your consent; to establish, exercise, or defend legal claims; or to protect the rights of another.

Withdrawal of Consent. You can withdraw your consent where processing is based on consent you have previously provided. If we receive notification that you have withdrawn your consent to use the personal data for the purposes set out in the table above (see ‘Purposes for which we will use your personal data’), we will no longer process such personal data and, subject to our retention policy, we will dispose of the personal data securely. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you have questions about how to withdraw a consent you have provided, please contact us by emailing privacy@smartsheet.com or by using the contact details provided under the ‘How to Contact Us’ heading.

Exercise of Rights. To exercise your rights, please contact us by emailing privacy@smartsheet.com or using the contact details provided under the ‘How to Contact Us’ heading. We do not discriminate based on whether you choose to exercise your choices and rights. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

 

8.    OTHER RELEVANT PROVISIONS

For information on our security practices and retention policy, please see our Privacy Notice at www.smartsheet.com/legal/privacy. 

 

9.    GLOSSARY

LAWFUL BASIS

• Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific processing activities by contacting us by emailing privacy@smartsheet.com or using the contact details provided under the ‘How to Contact Us’ heading.
• Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

 

Last updated: August 9, 2022