Data Protection Policy

Data Protection and Privacy Policy for USU Software AG

We at USU are delighted at your interest in our Internet presence and our services. Protection of personal data has a particularly high priority for us. This policy aims to inform you about whether and how personal data is collected and processed in connection with the use of our Internet presence and about your rights as a data subject in this context.

As the controller, USU Software AG has implemented numerous technical and organizational measures to ensure that personal data processed on this website is protected as fully as possible. Nevertheless, data transfers over the Internet may fundamentally have security loopholes, and thus total protection cannot be guaranteed.

I. Name and address of the controller responsible for processing data

With regard to the use of our website www.usu.com and its subpages, as well as the linked websites and social media presences of USU Group companies, the controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation applicable to us is:

USU Software AG
Spitalhof
71696 Möglingen
Germany

Phone: +49 7141 4867 0
Fax: +49 7141 4867-200
E-mail: info(at)usu.com

II. Collection and storage of personal data in connection with visits to our website; nature and purpose of its use

1. Security

If personal data is transmitted to us over our website, we use numerous secure technologies, in particular the Transport Layer Security (TSL) and Secure Socket Layer (SSL) transfer protocols. All information and data transferred using these secure methods is encrypted before being sent to us. The IP address of the system used to call the website is transmitted to us so that our users – and USU as well – are protected against misuse.

2. Recording of general data and information

Whenever it is called, our website records a number of items of general data and information that are stored in the server’s log files. The following may be recorded:

  1. The types of browser used and their versions
  2. The operating system used by the system accessing our website
  3. The website from which a system accesses our website (referrer)
  4. The subpages accessed by a system on our website
  5. The date and time our website was accessed
  6. The Internet Protocol (IP) address of the system calling our website
  7. The Internet service provider of the system accessing our website
  8. Other similar data and information that helps repel threats in the event that our IT systems are attacked.

We do not use this general data and information to identify the data subject. This information is required instead (1) to deliver our website’s content correctly, (2) to optimize our website’s content and advertising for it, (3) to ensure that our IT systems and our website’s technology keep running properly, and (4) to provide law-enforcement authorities with the information required to prosecute any cyberattacks that occur. This data and information, which is collected anonymously, is therefore analyzed statistically, in part with the objective of increasing data protection and data security at our company and thus ultimately ensuring an ideal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from all personal data provided by a data subject.

3. Cookies

Our website uses cookies, which are text files that are placed and stored by a web browser on a computer system. Many websites and servers use cookies. Many cookies contain a cookie ID that uniquely identifies the cookie. It consists of a character string that permits websites and servers to be linked to the specific web browser in which the cookie was stored. As a result, the websites visited and servers can distinguish the data subject’s individual browser from other web browsers containing other cookies. A particular web browser can be recognized and identified by the unique cookie ID.

By using cookies, USU can provide users of this website with more user-friendly services, which would not be possible without the placement of cookies. A cookie can help us optimize the information and offers on our website to suit users’ needs. As already mentioned, cookies enable us to recognize users of our website. The purpose of that is to make our website easier to use. If you call a website that uses cookies, you do not need to enter your access data again every time you visit it, for example, since the website and the cookie stored on your computer system do this for you. Another example is the cookie of a shopping cart in the online shop. A cookie helps the online shop remember the articles a customer has placed in the virtual shopping cart.

Data subjects can prevent cookies from being placed by our website at any time by making the relevant settings in their web browsers and thus permanently objecting to the placement of cookies. They can also, at any time, delete cookies that have already been placed by using their web browsers or other software programs. This is possible in all common web browsers. If data subjects disable cookies in their web browsers, they may not be able to use all the functions of our website in full.

4. Registration on our website

Data subjects can register on our website, which involves providing personal data. The personal data sent to us is defined in the input screen used for registration, and once entered it is collected and stored solely for the specified purpose. We can transmit it to one or more processors so that it can be processed as stipulated, or to a USU Group company, if that is necessary to fulfill the specified purpose. If data subjects register on our website, the IP address assigned by their Internet service providers (ISP) to the system they use is stored along with the date and time of registration. This data is stored because it is the only means of preventing misuse of our services and so that it can be used to investigate criminal acts, if necessary; in this respect, the storage of this data is necessary as a safeguard for the controller. By registering and voluntarily disclosing their personal data, data subjects help us offer them content or services which, due to their nature, can only be offered to registered users.

5. Subscription to a newsletter

Users can subscribe to newsletters on our website. The personal data sent to us when a newsletter is ordered is as defined in the input screen used for subscribing. USU regularly informs its customers and prospects about what the company has to offer by means of a newsletter. Data subjects can only receive the newsletter if (1) they have a valid e-mail address and (2) they have registered for the newsletter or have an active contractual relationship with USU and the newsletter in question contains information of relevance to the contractual partner. The law requires us to send a confirmation message to the e-mail address the data subject has specified when subscribing to the newsletter (double opt-in method). This confirmation message helps us verify that the owner of the e-mail address is the data subject and has authorized receipt of the newsletter.

If data subjects register for the newsletter, we also store the IP address assigned by their Internet service providers (ISP) to the system they used at the time of registration, as well as the date and time of registration. This data must be collected in order to ascertain any (possible) misuse of a data subject’s e-mail address at a later time, and thus is a legal safeguard for the controller.

The personal data collected during registration for the newsletter is used solely for sending out the newsletter. In addition, newsletter subscribers can be notified by e-mail if this is necessary for the operation of the newsletter service or if registration is required, such as may be the case if there are changes in the newsletter offer or technical circumstances. The personal data collected as part of the newsletter service is not transmitted to third parties, with the exception of the persons responsible for the newsletter’s contents at the USU Group. Data subjects can cancel their subscriptions to the newsletter at any time. Data subjects can, at any time, withdraw their consent to storage of personal data they have given us (solely) for newsletter distribution. Every newsletter contains a link that can be used to withdraw consent. Data subjects can also cancel their subscriptions to the newsletter at any time directly on the controller’s website or use other means to notify the controller of their requests to cancel it.

6. Tracking

USU’s newsletters contain tracking pixels. A tracking pixel is a miniature graphic that is embedded in e-mails sent in HTML format to enable recording and analysis of log files. This permits statistical evaluation of the success or lack of success of online marketing campaigns. The embedded tracking pixel allows USU to recognize whether and when a data subject has opened an e-mail message and what links in the e-mail were called. We store and analyze the personal data collected by tracking pixels contained in the newsletters in order to optimize newsletter distribution and tailor the content of future newsletters even better to the interests of the data subject. However, data subjects can, at any time, withdraw the separate consent they have given to this practice, which uses the double opt-in method. When a subscription to the newsletter is canceled, USU automatically interprets that as a withdrawal of such consent.

In order to constantly improve our website, we use the web analysis service Lucky Orange. Lucky Orange creates heat maps and records based on the click behaviour of website visitors. With the help of this information we are able to identify and resolve problems with the use of our websites and thus provide a better user experience. Cookies are stored on your computer for analysis purposes. The storage of cookies can be prevented in the settings of your web browser. IP addresses are anonymized so that an exact identification is impossible.

If you would like to object to tracking by Lucky Orange, you can exclude yourself from tracking at any time via the following link: https://privacy.luckyorange.com

For more information about Lucky Orange's privacy policy, please visit https://www.luckyorange.com/privacy.php .

7. Contacting us via the website

In compliance with statutory requirements, our website contains information that enables rapid electronic contact with us and allows the other USU Group companies to communicate directly with us. That information likewise comprises a general e-mail address. If data subjects contact the controller by e-mail or using a contact form, the personal data they send is automatically stored. Personal data given to the controller voluntarily in this way is stored so that the request can be handled or the data subject contacted.

8. Comment function in the blog on the website

On our website, we offer users the possibility of leaving individual comments on individual posts in a blog there. A blog is a portal on a website that can usually be viewed by the public and in which one or more persons (called bloggers) post articles or write down their thoughts in what are termed blog posts. Third parties can usually submit comments to the blog posts. If data subjects leave comments in the blog on our website, the comments they leave, as well as details of the time they entered them and their chosen user names (pseudonym), are stored and published. The IP address assigned by the Internet service provider (ISP) to the data subject’s system is also logged. The IP address is stored for security reasons and for the eventuality that a data subject submits a comment that infringes third-party rights or posts unlawful content. In other words, this personal data is stored in the controller’s interests as exculpatory evidence in the event of a violation of the law and is not transmitted to third parties unless prescribed by law or to help the controller defend against legal action.

9. Additional data protection regulations on the use of Google Analytics (with an anonymization function)

We would like to point out that the USA is assessed by the European Court of Justice as a country with an insufficient level of data protection according to EU standards. When your data is processed by Google in the USA, for example, there is a risk that data may be viewed by US authorities. Within the scope of our possibilities, we also take measures to counter these risks as far as possible.

The above data processing, including the transfer of data to Google, will only take place after your active consent to this data processing for the purpose of providing the content, so that the basis for this is your consent in accordance with Article 6 (1) subparagraph 1 letter a) DSGVO. This consent can be revoked at any time with effect for the future; please bear in mind that the data processing by Google that took place before the revocation is not affected by this.

If and to the extent that data is additionally transferred to the USA, we will take the precautions within our power to ensure adequate protection for the data transfer in accordance with Art. 44 ff. DSGVO, for example by agreeing to the standard data protection clauses of the EU Commission pursuant to Article 46(2)(c) DSGVO and, if necessary, additional measures.

The component Google Analytics (with an anonymization function) is integrated in our website. Google Analytics is a web analytics service. Web analytics is the collection, gathering and analysis of data on the behavior of visitors on websites. Among other things, a web analytics service records data on the website from which a data subject accesses a website (referrer), which subpages on the website are accessed, or how often and for how long a subpage was viewed. Web analytics is mainly used to optimize a website and to conduct a cost-benefit assessment of Internet advertising. The operator of the Google Analytics component is the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA. We use Google Analytics with the “_gat._anonymizeIp” extension. With this extension, Google truncates and anonymizes the IP address of the system used by the data subject if our website is accessed from a Member State of the European Union or another country that is party to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyze visitor flows on our website. Among other things, Google uses the data and information it gathers for evaluating the use of our website, compiling online reports on activities on our web pages for us, and providing services related to the use of our website. Google Analytics places a cookie on the data subject’s IT system. Cookies have already been explained above. Placement of the cookie enables Google to analyze the use of our website. Whenever a data subject calls an individual page of our website that we operate and on which a Google Analytics component has been integrated, the web browser on the data subject’s IT system is automatically prompted by the Google Analytics component to transmit data to Google for the purpose of online analysis. As part of that technical process, Google gains knowledge of personal data, such as the IP address of the system used by the data subject. This helps Google trace the origin of visitors and clicks and thus, for example, enable commission to be charged. The cookie is used to store personal information, such as the time at and place from where our website was accessed and how often the data subject visited it. Whenever our web pages are visited, this personal data (including the IP address of the system used by the data subject) is transferred to Google in the United States of America and stored by Google there. Google may transmit the personal data collected by this technical method to third parties.

As described above, data subjects can, at any time, prevent cookies from being placed by our website by making the relevant settings in their web browsers and thus permanently objecting to the placement of cookies. Such a setting in the web browser would also prevent Google from placing a cookie on the data subject’s IT system. In addition, a cookie that has already been placed by Google Analytics can be deleted at any time in the web browser or by using other software programs.

Moreover, data subjects can object to and prevent recording of the data generated by Google Analytics and relating to the use of this website and the processing of that data by Google. To do that, a data subject must download and install a browser add-on under the link tools.google.com/dlpage/gaoptout . This browser add-on notifies Google Analytics by means of JavaScript that no data and information on visits to websites may be transmitted to Google Analytics. Installation of the browser add-on is interpreted by Google as an objection to the recording of data. If the data subject’s IT system is deleted, formated or reinstalled later, the browser add-on must be installed again in order to disable Google Analytics. If the browser add-on is deinstalled or disabled by data subjects or other persons in their sphere of influence, the browser add-on can be reinstalled or reactivated.

More information and Google’s Privacy Policy can be found at https://www.google.de/intl/de/policies/privacy/ and https://www.google.com/analytics/terms/de.html . More detailed explanations on Google Analytics can be found at https://www.google.com/intl/de_de/analytics/ .

10. Links to third-party websites

USU’s website contains links to other websites. By clicking these links, you leave the USU website. The presence of these links on USU’s website does not mean that USU supports, promotes or claims ownership of the sites to which we provide links. These linked sites are beyond the control of USU and USU accepts no responsibility for these linked websites, in particular for their content, their data protection and privacy policies or any possible transmission of data by them.

Under the following links, you can view the data privacy policies of the social media channels that have links on our websites:

11. Service provider and partner

You can find our service providers recorded as part of the consent to the processing of personal data here:

Email Marketing & CRM

Webinars & Online Events

Surveys

Cookie Consent Manager

Ads & Tracking

Social Media

Hosting & Service provider

You can find an overview of our partners here.

12. Gartner

The Gartner Peer Insights Customer First badge is a trademark and service mark of Gartner, Inc., and/or its affiliates, and is used herein with permission. The Gartner Peer Insights Customer First program constitutes an organization's commitment to solicit reviews from its customers using programmatic sourcing strategies and best practices. They neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.

III. Collection and processing of personal data for job applications and in the application process

We collect and process personal data from job applicants so as to handle the application process for all companies belonging to the USU Group. That may also be done electronically. That is the case in particular when applicants send their application documents to the controller electronically, such as by e-mail or using a form on the website. If the controller concludes an employment contract with an applicant, the data provided is stored for use as part of the employment relationship in compliance with statutory provisions. If the controller does not conclude an employment contract with an applicant, the application documents are destroyed or erased when a decision to reject the applicant is made, unless the controller has other legitimate interests for not doing do. A legitimate interest here is, for example, the requirement of furnishing proof in the event of possible legal action under the German General Act on Equal Treatment (AGG).

IV. Collection and processing of personal data as part of commissions

Personal data is collected and processed as part of commissions on the basis of the requirements for the specific commission and is usually done by the respective USU Group company itself as the controller. In this regard, any processing activities by USU Software AG are carried out solely in its capacity as a “processor.”

V. Legal grounds for processing

  • The legal basis for our company for processing operations where we obtain consent to process data for a specific purpose is Article 6 (1) (a) GDPR.
  • If personal data has to be processed for the performance of a contract to which the data subject is a party, such as is the case with processing operations required to supply goods or provide another service or consideration, the legal basis for that is Article 6 (1) (b) GDPR. The same applies to processing operations required for performance of steps prior to entering into a contract, such as is the case when we receive inquiries about our services.
  • If we are subject to a legal obligation that requires processing of personal data, such as to fulfill tax-related obligations, the basis for that is Article 6 (1) (c) GDPR.
  • Finally, processing operations may be based on Article 6 (1) (f) GDPR, which is the legal basis for processing operations that are not covered by any of the above legal grounds, when processing is necessary to safeguard the legitimate interests of a USU Group company or a third party (e.g. a customer), unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject. In relation to our website, that applies in particular to processing operations in accordance with Section II of this Data Protection and Privacy Policy. We are, in particular, permitted to carry out such processing operations because they have been mentioned specifically by the European legislator, which was of the opinion that a legitimate interest could be assumed if the data subject is a customer of the controller. A further legitimate interest is to conduct our business activity for the well-being of our employees and shareholders, as well as processing for direct marketing purposes, in particular to send information on products and services, invitations, information on events and the like.

VI. Transmission of personal data

Personal data is transmitted to third parties only if that is authorized under data protection law, for example on the grounds specified under Section V of this Data Protection and Privacy Policy, and to external service providers for processing on behalf of the controller and subject to its instructions. In general, data is not processed outside the EU or EEA. If data needs to be transmitted to a country outside the EU or EEA in an individual case, this is done solely on the basis of the EU standard contractual clauses or to countries for which an adequacy decision has been adopted by the EU and under a contract on processing on behalf of the controller. We will not sell your personal data to third parties or otherwise market it.

VII. Length of time for which personal data is stored

The criterion for storing personal data is the respective statutory retention period. When this period ends, the data in question is routinely deleted, if and to the degree that it is no longer required to perform a contract or steps prior to a contract. However, data will continue to be stored if the data subject’s interests in having the data deleted are overridden by the legitimate interests of the controller, such as to safeguard its means of defending against legal action and indemnity insurance cover for potential rights of recourse by customers and/or data subjects where the period of limitation has not yet expired. If there is no such legitimate interest, this data is also routinely erased.

VIII. Rights of data subjects

Data subjects have the right to:

  • Demand, in accordance with Article 15 GDPR, information on and access to their personal data we have processed. In particular, they can demand information on the purposes of processing, the category of personal data, the categories of recipients to whom their data has been or will be disclosed, the length of time it is to be stored, the existence of a right to rectification, erasure or restriction of processing of their data or to object to its being processed, the existence of a right to lodge a complaint, and the origin of their data if it is not collected by us, as well as the existence of automated decision-making, including profiling, and any meaningful information about the details of that (we point out here that we do not use profiling);
  • Demand, in accordance with Article 16 GDPR, immediate rectification of incorrect personal data we have stored concerning them and demand that incomplete personal data is completed;
  • Demand, in accordance with Article 17 GDPR, erasure of personal data we have stored concerning them, unless processing of it is required for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims;
  • Demand, in accordance with Article 18 GDPR, restriction of processing of their personal data, if they dispute the correctness of the data, processing of it is unlawful, but they oppose its erasure and we no longer need the data, but they need it to establish, exercise or defend legal claims, or they have objected to processing of their data in accordance with Article 21 GDPR;
  • Receive the personal data they have provided, in a structured, commonly used and machine-readable format or demand that their data be transmitted to another controller in accordance with Article 20 GDPR;
  • Revoke their consent to processing of their data at any time in accordance with Article 7 (3) GDPR. As a consequence, we will, with future effect, no longer be allowed to continue processing the data on the basis of their prior consent; and
  • Lodge a complaint with a supervisory authority in accordance with Article 77 GDPR, which can usually be done with the supervisory authority responsible for the person’s habitual residence, place of work or our company’s domicile. In the latter case, the authority is: Landesbeauftragte für den Datenschutz und die Informationsfreiheit (The State Commissioner for Data Protection and Freedom of Information) Baden-Württemberg, Königstrasse 10 a, 70173 Stuttgart, Germany

IX. Right to object

If your personal data is processed to safeguard legitimate interests in accordance with Article 6 (1) sentence 1 (f) GDPR, data subjects have the right under Article 21 GDPR to object to processing of their personal data if there are grounds relating to their particular situation or the objection is to direct marketing. In the latter case, data subjects have a general right to object and we will comply with that right without any need for them to specify grounds relating to their particular situation. If you wish to make use of your right to revoke your consent or object to processing, simply send an e-mail to: webteam(at)usu.com

X. Contact data of the Data Protection Officer

The contact data of our Data Protection Officer is:

USU Software AG
Datenschutzbeauftragter (Data Protection Officer)
Spitalhof
71696 Möglingen
Germany

Phone: +49 7141 4867 0
E-mail: privacy@usu.com

XI. Up-to-date status of and amendments to this Data Protection and Privacy Policy

This Data Protection and Privacy Policy is currently valid in its version dated May 2018. This Data Protection and Privacy Policy may need to be amended if our website and offerings are developed further or pursuant to changes in the law or official requirements.

Privacy Policy for USU Solutions Inc.

I. Introduction

This privacy policy (“Policy”) describes how USU SOLUTIONS, INC. , Boston, MA ,(“USU”, “we” or “us”) collects, uses and shares personal information of users of the USU websites (the “Websites”) or any products or services available on or through the Websites. USU is the sole owner of the information collected on the Websites or through your use of Products and services (the “Products”). We will not sell, share, or rent this information to others in ways different from what is disclosed in this Policy.
Further, USU respects your privacy and is committed to protecting your personal data in line with all applicable laws and regulations.  This Policy will inform you as to how we will look after your personal data when you interact with us, including visiting our Websites. It also tells you about your rights in relation to your personal data.

II. Acceptance of Privacy Policy

By using the Websites and clicking “Accept” on the Cookie Banner contained on our Websites and/or by using our Products, you consent to the collection, use and storage of your information by us in the manner described in this Policy. We reserve the right to make changes to this Policy at any time. If we decide to change our Policy, we will post those changes on our Websites so our users are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If you do not agree with this Policy, please do not use our Websites. Your continued use of our Websites following posting of changes to these terms will mean you accept those changes.

III. What is personal data and who is responsible for looking after my personal data?

Personal data is any information about an identifiable individual. USU is responsible for personal data which we collect from you and, along with any of our distributor’s partners, resellers, dealers and other sales channels, we are also responsible for how we handle personal data which we collect from USU’S sales partners.

IV. Websites

1. Data Collected And Its Use

USU allows you to voluntarily provide us with contact information through our website and when you are purchasing or redeeming offers. The information we may collect from you includes, but is not limited to, your name, email address, phone number, and past purchases. We do not collect or store credit card information.  Any payments you make for Products are made through third- party payment processing vendors, and we have no access to such information. In addition, if you contact us, we may keep a record of your communication to help solve any issues you might be facing. 

Finally, we may receive contact details or other information about you from publicly and commercially available sources, which we may combine with other information we receive from or about you. We will use the information we collect from third party sources in accordance with this Privacy Policy. If you have requested information or if you have purchased products or services from us in the past, we may use this information to provide you with news, offers for upgrades, discounts and other marketing information. But we only want to stay in contact with people that are interested in what we’re doing. If you do not wish to receive marketing communications from USU, you can opt-out in the manner designated in the marketing communication or by contacting our Data Protection Office at privacy(at)usu.com.

If you use a blog, bulletin board or similar means of communication on or through our Websites, you should be aware that any data you submit there can be read, collected, or used by other users of these forums. We use industry standard measures, including administrative, technical, and physical safeguards, to help protect personal data from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. However, no data transmission over the Internet can be guaranteed to be entirely secure.

As a result, while we always use all reasonable efforts to protect your personal data, we cannot guarantee the security of your information and the submission of data is thus at your own risk.

2. Data Integrity And Security

USU uses industry standard security measures to protect against the loss, misuse and/or alteration of data located on our systems. We implement appropriate measures and processes, such as using encryption when transmitting certain sensitive information, to help us to keep your information secure and to maintain its quality. We regularly review our security and related policies to adapt the technology as new threats evolve, and monitor our systems to help ensure the highest level of availability. If you have any questions about the security at our Websites, you can reach out to us at security(at)usu.com.

3. Lawful Grounds For Using Your Personal Data

There are various lawful grounds on which we use your personal data including the following legitimate interests:
(a) understanding how our customers use our products and services;
(b) keeping our records up to date; to develop our products and services and to grow our business;
(d) to inform our marketing strategy including to define customers for our products and services.

4. Non-Personal Data

USU collects non-personal identification information about you whenever you interact with our website. Non-personal identification information may include browser name, type of computer, and technical information about your means of connecting to our website, such as the operating system, the Internet service provider utilized, and other similar information. We use this information to optimize and improve our website.

5. Cookies And Web Beacons

USU uses cookies on its website. These cookies are stored by your browser for record-keeping purposes.  Also, through the use of cookie technology or otherwise, we may track and collect information about your computer and software when you visit the Websites or use our products or services. This information is automatically collected, and may include, but is not limited to:

(i) your Internet Protocol (“IP”) address;
(ii) domain server;
(iii) type of computer;
(iv) your operating system;
(v) type of web browser and browser language;
(vi) access times;
(vii) pages viewed and how long you spend on a page;
(viii) referring website addresses; and
(ix) other information about your use of and actions on our Websites (collectively “Traffic Data”).

Traffic Data is anonymous information that does not personally identify you. Traffic Data assists us to design and arrange our web pages in the most user-friendly manner and to continually improve our Websites to better meet the needs of users. USU also analyzes the data through the use of third parties.
You can find our service providers recorded as part of the consent to the processing of personal data here:

Email Marketing & CRM

Webinars & Online Events

Surveys

Cookie Consent Manager

Ads & Tracking

Social Media

Hosting & Service provider

You can find an overview of our partners here.

We may also use web beacons (small pieces of data that are embedded in images on the pages of Websites) and auditing software to track page views and entry and exit points to and from our Websites. In addition, we may use web beacons, cookies, customized links and/or similar technologies to determine whether electronic newsletters sent by us to those who have requested them from us have been opened and which links are clicked. Any data collected will only be used in an aggregate form and will not contain any personal information, as that term is defined below.
You may choose to set your web browser to refuse cookies. You may also opt out of a third-party vendor’s use of cookies by using the NIA opt-out site at  http://www.youronlinechoices.com/, or for those in Europe, the EDAA opt out site at http://www.youronlinechoices.com/. A user who does not accept cookies from our Websites may not be able to access certain areas of the Websites.
Further, third-party vendors including AdRoll, Google, and LinkedIn may use the cookie information about your prior visits to the USU website in order to place targeted USU advertisements on other Websites you visit. Some USU downloads or software may generate a computer ID value during installation. This ID does not contain any specific information about you or the data on your computer.

6. Surveys And Responsive Requests

If you have opted to participate, from time to time, we may request information from users via surveys or similar responsive requests. Participation in these surveys or responsive requests is completely voluntary and the user therefore has a choice whether or not to disclose this information. Information requested may include contact information (such as name, email and shipping address), and demographic information (such as zip code, age level). If you give us personal information about somebody else, such as a spouse or work colleague, we will assume that you have their permission to do so. Survey information may be used to monitor or improve the use and satisfaction of the Websites or our products and services.

7. Information Sharing And Disclosure

USU will not sell or rent any personal data, except to successors in interest, without your consent. USU reserves the right to release account information when exchanging information with other companies and organizations for fraud protection and credit risk reduction.
USU will share personal data when it is necessary to provide the product or service you have requested. 
USU also shares personal data with service providers as needed for them to provide us with services that help us with our business activities and to provide our services (such as website analytics, email delivery, marketing/advertising and legal and other professional advice). We do not allow these third-party service providers to use your personal data for their own purposes and only permit them to access and process your personal data for specified purposes and in accordance with our instructions. Learn more about our third-party subprocessors.

USU may share personal data with its affiliates, partners, distributors, resellers, representatives and agents (“Partners”) to enable Partners the opportunity to market, offer and provide USU products and services to you as well as Partner products and services that are compatible with USU products and services.
USU will share personal data to respond to subpoenas, court orders or legal process or if USU finds that your actions on our Web Websites violate our usage guidelines. This policy does not protect information you post to any on-line bulletin board, chat room, newsgroup or other public forum from within our Web Websites.

If we are involved in a merger, acquisition or asset sale, such information may be shared with the acquiring entity or successor-in-interest, but we will continue to ensure the confidentiality of any personal data pursuant to the terms of this Policy.
We may also share personal data in the event of an emergency, for the protection and safety of our employees and agents, our customers, or any other person, and we also may be required to disclose an individual’s personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. 

8. Other Websites

Our Websites may contain links to other websites on the Web. USU has no control over these external Websites and is not responsible for the privacy practices or content of these Websites. We advise you to read the privacy policies of those websites thoroughly so that you are aware of the manner in which those websites will use your personal data.
USU reserves the right to remove content that does not comply with the conduct stated above or is otherwise deemed objectionable. USU reserves the right, in its sole discretion, to terminate your access to any part or this entire site without notice.

V. Products - data collected and its use

1. Information We Collect from the Products

USU automatically collects “Operations Data” and “Product Usage Data” from your use of the Products. Operations Data is information we use to facilitate the delivery of the Products, manage and monitor infrastructure, and provide support. Product Usage Data is information we use for product analytics and improvement. This information is generally technical and aggregated but may include limited Personal Data such as IP/MAC addresses and identifiers (including cookies). Depending on the Product, the information may include:

  • Products and System Data: this is information about the Products you are using and about the systems and related environment from which you access the Service. Examples include Product type and version, license information, installed plug-ins, UUID, and third-party systems used in connection with the Product.
  • Data Entered into User Interface: This may include user info, billing info, cluster and catalog info, query details, etc. Some of this data may be sensitive, as users are permitted to enter anything into the query editor.
  • Performance Data: this is information about the performance of the Products. Examples include metrics on the performance and scale of the Products and response times.
  • Feature Usage Data: this is information about how the Products are used. Examples include details about which features are used and user interface metrics.

2. How We Use Information We Collect from the Products

USU uses the information automatically collected from the Products to support our customers and improve the Products generally; more detailed information is provided below. USU strives to collect only the minimum amount of information needed to achieve these purposes. 

3. How we use Product Usage Data

USU uses Product Usage Data to improve our Products, support our Customers, support business to business marketing and sales, comply with legal requirements, and for other legitimate business purposes. More information on each category follows:

  • Product Improvement: USU may use Product Usage Data to analyze the use of the Products; prioritize testing and development of new features and functionality; improve our support responses; improve forecasting; make pricing and packaging decisions; identify, understand, and anticipate performance issues and the factors that affect them;
  • Customer Support: USU may use Product Usage Data to provide proactive or reactive support to our customers, such as guidance to help optimize usage; identifying product improvement opportunities; prioritize future product features; personalize your experience and suggest other products and services, and increase engagement and adoption of our features (e.g., by providing in product suggestions).
  • Business to Business Marketing and Sales: Where permitted by law, USU may use Product Usage Data to market additional Products to our customers and to inform sales discussions.
  • Legal Requirement: USU may be required to access Personal Data contained in Product Usage Data as required by law, such as to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect or defend our rights or property of USU or users of the Products, protect the safety of others, to investigate fraud, or respond to government requests, including public and government authorities outside a user’s country of residence, for national security or law enforcement purposes.
  • Other Legitimate Business Purposes: USU may use Product Usage Data when it is necessary for other legitimate purposes.

4. How we use Operations Data

USU uses Operations Data for purposes including to facilitate Product delivery, administer accounts, provide support, and for other legitimate business purposes. More information on each category follows:

  • Facilitate the delivery of the Products: USU may use Operations Data to facilitate the delivery of the Products.
  • Conduct account administration and similar Products related activities: USU may use Operations Data to provide the Products and for account management. Examples include managing Product downloads, updates, and fixes, and sending other administrative or account-related communications, including release notes and billing information.
  • Provide support: USU processes Operations Data when users contact USU via one of our support channels so that we can contact them about the relevant support request. In some cases, users may need to send us copies of any affected files, logs, or other information to enable us to assist with the support request. In such cases, we will use such information to respond to, troubleshoot, and otherwise resolve the support request.
  • Confirm customer compliance with contractual obligations: USU may use Operations Data to confirm compliance with contractual and other terms of use obligations in connection with the relevant Products.
  • Other legitimate business purposes: USU may use Operations Data when it is necessary for other legitimate USU business purposes related to the Products.

5. Limitations on How We Share Information We Collect from the Products

We take care to ensure that data you provide to us is accessed internally only by individuals that require access to perform their tasks and duties, and externally only by service providers with a legitimate purpose for accessing it. Such service providers are required by contract to safeguard any Personal Data from us and are prohibited from reusing the Personal Data for any purpose other than to perform the services as instructed by USU. We will not sell your Personal Data or allow a third party to use your Personal Data for its own commercial purpose.

6. How We Use Cookies and Automatic Data Collection Tools

Depending on the Product you use, we may use cookies or other tracking technologies in furtherance of the purposes described in this Statement. The types of technology we use may change over time. Some of these technologies are essential for the provision of the Products, such as account access and authentication; others assist with the performance and functionality of the services, such as recognizing returning users or remembering preferences; and others enable us to analyze and customize the Products.

7. Legal Basis for Processing Information We Collect from the Products

Our legal basis for processing Personal Data contained in information we collect from the Products in the European Economic Area (EEA) and the UK is our legitimate interest in performing, improving, maintaining, and securing our Products and operating our business efficiently and appropriately. We have assessed that these legitimate interests are not overridden by the data protection interests or fundamental rights of any individuals.
If you have questions about or need further information concerning the legal basis on which we collect and use Personal Data in relation to our Products, please contact us at privacy(at)usu.com.

VI. How long will we keep your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances you can ask us to delete your data: see the “Your rights” section below for further information.
In some circumstances we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

VII. Your rights under applicable data protection laws

Under certain circumstances, you have rights under data protection laws in relation to your personal data. We have explained your rights below; if you wish to exercise any of your rights, please contact us at privacy(at)usu.com.
You have the right to:

  • Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  • Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
  • Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  • Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
  • Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.  If you do not want to receive promotional or other e-mail from USU, you can remove yourself from our mailing lists.

VIII. Your right to make a complaint and how to contact us

Your privacy is very important to us. You have the right to make a complaint at any time to the supervisory authority for data protection issues in your state or country. We would, however, appreciate the chance to deal with your concerns so if you have any questions or concerns regarding our Data Privacy Policy please contact us at privacy(at)usu.com.

IX. What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

X. Choice and Access; Time Limit to respond

We will provide an individual opt-out or opt-in choice before we share their data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized.
To limit the use and disclosure of your personal information, please submit a written request to privacy(at)usu.com. We will respond within a reasonable time frame.

XI. Children's Privacy

The Children’s Online Privacy Protection Act restricts the collection and use of Personal Information pertaining to children under the age of 13.  We do not allow such children to register as users and will not knowingly collect or solicit Personal Information from anyone under the age of 13.  No one under the age of 13 should provide any Personal Information on or through this Site or otherwise.  In the event we learn that we have collected Personal Information from a child under age 13, we will terminate the any account and communications, and delete such information.  If you believe that we might have any information from or about a child under 13, please contact us at  privacy(at)usu.com.  Minors aged 13 and over should not use this site or post any information or other content without adult supervision.

XII. California notices

Users who reside in California and have provided personal data to us have the right to receive: (a) information identifying any third party to whom we may have disclosed, within the past year, personal data pertaining to you and your family for that party’s direct marketing purposes; and (b) a description of the categories of personal data disclosed. To obtain such information, please email your request to  privacy(at)usu.com. This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than to the address specified in this paragraph.

XIII. Additional important information for California residents

This section applies only to California residents. It describes how we collect, use and share Personal Information of California residents when we act as a “business” as defined under the California Consumer Privacy Act of 2018 (“CCPA”), and their rights with respect to their Personal Information.  For purposes of this section, “Personal Information” has the meaning given in the CCPA but does not include information exempted from the scope of the CCPA or information we collect from you in the course of providing services to you or receiving services from you where you are an employee, controlling owner, director, officer or contractor of a company, partnership, sole proprietorship, non-profit or government agency.  In some cases, we may provide a different privacy notice to certain categories of California residents, such as job applicants, in which case that notice will apply instead of this section.
Your California privacy rights. As a California resident, you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

  • Information.  You can request the following information about how we have collected and used your Personal Information during the past 12 months:
    • The categories of Personal Information that we have collected.
    • The categories of sources from which we collected Personal Information.
    • The business or commercial purpose for collecting and/or selling Personal Information.
    • The categories of third parties with whom we share Personal Information.
    • Whether we have disclosed your Personal Information for a business purpose, and if so, the categories of Personal Information disclosed to each category of third party recipient.
    • Whether we’ve sold your Personal Information, and if so, the categories of Personal Information received by each category of third party recipient.
  • Access.  You can request a copy of the Personal Information that we have collected about you during the past 12 months.
  • Deletion.  You can ask us to delete the Personal Information that we have collected from you.
  • Opt-out of sales.  If we sell your Personal Information, you can opt-out.   In addition, if you direct us not to sell your Personal Information, we will consider it a request pursuant to California’s “Shine the Light” law to stop sharing your personal information covered by that law with third parties for their direct marketing purposes.
  • Opt-in.  If we know that you are younger than 16 years old, we will ask for your permission (or if you are younger than 13 years old, your parent’s or guardian’s permission) to sell your Personal Information before we do so.
  • Nondiscrimination.  You are entitled to exercise the rights described above free from discrimination in the form of legally prohibited increases in the price or decreases in the quality of our Service.

How to exercise your California privacy rights

You may exercise your California privacy rights described above as follows:

  • Right to information, access and deletion. You may exercise your right to information, access or deletion of your personal information by contacting us at privacy(at)usu.com. We will make commercially reasonable efforts to process all verifiable consumer requests within a forty-five (45) day period, per CCPA requirements.

We reserve the right to confirm your California residency to process your requests and will need to confirm your identity to process your requests to exercise these rights.  Government identification may be required.  You may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification.  We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

XIV. International transfers

USU is an entity which is based in the United States of America and many of our service providers are based in the USA. This means that if you reside outside of the USA, your personal data will be transferred to the USA.  If you reside in the European Economic Area or the UK, we will protect your personal data in accordance with The General Data Protection Regulation (GDPR).

XV. GDPR Privacy

Legal Basis for Processing Personal Data under The GDPR

We may process your personal data under the following conditions:

  • Consent: You have given your consent for processing personal data for one or more specific purposes.
  • Performance of a contract: Provision of personal data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.
  • Legal obligations: Processing personal data is necessary for compliance with a legal obligation to USU is subject.
  • Vital interests: Processing personal data is necessary in order to protect your vital interests or of another natural person.
  • Public interests: Processing personal data is related to a task that is carried out in the public interest or in the exercise of official authority vested in us.
  • Legitimate interests: Processing personal data is necessary for the purposes of the legitimate interests pursued by USU.

In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

XVI. Your rights under the GDPR

USU undertakes to respect the confidentiality of your personal data and to guarantee you can exercise your rights under the GDPR.
You have the right under the GDPR, if you are within the EEA or UK, to:

  • Request access to Your Personal Data. The right to access, update or delete the information we have about you. Whenever made possible, you can access, update or request deletion of your personal data directly within Your account settings section or by contacting us.
  • Request correction of the Personal Data that we hold about You. You have the right to have any incomplete or inaccurate information we hold about you corrected.
  • Object to processing of Your Personal Data. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation which makes you want to object to our processing of your personal data on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
  • Request erasure of Your Personal Data. You have the right to ask us to delete or remove personal data when there is no good reason for us to continue processing it.
  • Request the transfer of Your Personal Data. We will provide to you, or to a third-party you have chosen, your personal data in a structured, commonly used, machine-readable format.
  • Withdraw Your consent. You have the right to withdraw your consent for our use of your personal data. If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of our products and services.

XVII. Exercising your GDPR data protection rights - your right to make a complaint and how to contact us

You may exercise your rights under the GDPR by contacting us at privacy(at)usu.com. Please note that we may ask you to verify your identity before responding to such requests. 
You have the right to complain to your applicable data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. However, we would always welcome the chance to first address your concerns.

Your privacy and the security of your personal data is very important to us, so if you have any questions or concerns regarding our Privacy Policy or your personal data, please contact us at:

E-mail: privacy(at)usu.com
USU Solutions, Inc., Boston, MA

XVIII. Data privacy framework

USU complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. USU has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. USU has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Use of Personal Data for Social Media Contests and Campaigns

By entering a contest hosted by USU or engaging with a USU social media campaign, participants agree to the above Privacy Policy terms.
Contest entrants acknowledge that, unless restricted by law, they consent to any personal information provided in entering the contest or campaign to be used by USU for the purposes of administering the contest.
The winner’s name, profile photo and social media username may be posted on the social media profiles of USU after the winner has been selected. By entering the contest or engaging with the social media campaign, winners consent to this personal data being shared by USU.
When hosting a contest, campaign or sweepstakes, USU may request personal information from entrants, including, but not limited to:

  • Name
  • Email address
  • Phone number
  • Mailing Address
  • Job Title
  • Employer

The personal information we collect is used to contact entrants in the event that they are selected to win a prize. 
USU will make commercially reasonable efforts to secure all personal information shared by entrants as part of contests or social media campaigns. 
USU does not sell any personal information shared with us as part of social media campaigns or contests.