Supplemental Privacy Statements

This notice is being provided by Ping Identity Corporation and its EEA, Swiss and UK affiliates.

Ping Identity

1001 17th Street

Suite 100

Denver, CO 80202 USA

privacy@pingidentity.com

Ping Identity Corporation is based in the United States. Our representative in the UK is:

Ping Identity UK Limited

privacy@pingidentity.com

We have appointed a Data Protection Officer (DPO) who can be contacted at dpo_privacy@pingidentity.com

Our Privacy Policy for Professionals and Consumers explains the reasons why we process your Personal Information. We only process Personal Information when we have a legal basis for the processing, such as:

• To fulfill a contract with you or with your company (including providing support and service);
• For closely-related purposes, such as payment processing, account management, contract management, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance; and
• With your consent (or provided you have not objected, as may be applicable), to respond to requests for information and to provide you with marketing communications.

We may also process your Personal Information for the purposes of our legitimate interests, provided that such processing shall not outweigh your rights and freedoms. In particular, we may process your Personal Information as needed to:

• Provided you have not objected, send you our own marketing materials;
• Protect you, Ping Identity or others from threats (such as security threats or fraud);
• Comply with the laws that are applicable to us around the world,
• Enable or administer our business, such as for quality control, analytics, consolidated reporting, and product development;
• Manage corporate transactions, such as mergers or acquisitions; and
• Understand and improve our business or customer relationships generally.

We may use analytics for product development purposes, such as to understand product usage, or for security purposes, such as to identify unauthorized login attempts. We will not make automated decisions about you that may significantly affect you, unless (1) the decision is necessary as part of a contract that we have with you, (2) we have your explicit consent, or (3) we are required by law to use the technology.

In most cases, you are not required by law to provide any Personal Information to Ping Identity. You are required to provide certain Personal Information to enable us to enter into a contract with you, so that you can use our products and services. Our registration forms indicate which data elements are required for our contracts. If you do not provide these data elements, we cannot do business with you.

Ping Identity also respects your rights to access, correct and request erasure or restriction of your Personal Information as required by law. This means:

• You generally have a right to know whether Ping Identity maintains your Personal Information. If we do, you have the right to request a copy (subject to the rights of others), which may be provided in a portable format.
• If your information is incorrect or incomplete, you have the right to ask us to update it.
  
• You have the right to object to our processing of your Personal Information. If we are processing your Personal Information based on your consent, you have the right to withdraw your consent at any time.
• You may ask us to delete or restrict your Personal Information.

You can exercise your rights by visiting Your Privacy Choices.

If you believe that we have processed your Personal Information inappropriately, you may also contact us at privacy@pingidentity.com. If we do not resolve your complaint, you can also contact our data protection officer or your data protection supervisory authority in your country of residence.

As noted in the Ping Identity Privacy Statement, your Personal Information may be transferred to, stored at or processed in the United States and other countries which may not have equivalent privacy or data protection laws.

We generally use approved Standard Contractual Clauses to assure that Personal Information is adequately protected when it is transferred out of the European Economic Area or Switzerland, but we may also make transfers to recipients with approved Binding Corporate Rules or other approved mechanism.  We also participate in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).  Please see the Ping Identity Privacy Policy for additional information on our cross-border transfer safeguards. Please contact the privacy@pingidentity.com for a copy of the Standard Contractual Clauses.

We will retain your Personal Information for as long as the information is needed for the purposes set forth in Section 3 above and for any additional period that may be required or permitted by law. You may request that we delete your Personal Information by exercising Your Privacy Choices. Unless we have a compelling interest in retaining your information, it will be deleted it within 30 days of your request.

The CPRA provides California residents with specific privacy rights:

• The right to know what personal information and sensitive personal information we collect
• The right to access your personal information
• The right to correct inaccurate personal information
• The right to request that we delete your personal information
• The right to know what categories of personal information are sold to third parties and to opt-out of that sale
• The right to know what categories of personal information are shared with third parties for cross-contextual behavioral targeting and to opt-out that sharing
• The right to limit the use and disclosure of sensitive personal information, and
• The right not to be retaliated against for exercising your privacy rights

Personal information of children under 16 cannot be sold or shared without affirmative consent. We do not sell or share any personal information of children under 16 without affirmative consent.

If you are a California resident, you may exercise your rights by:

• Visiting our privacy rights portal at Your Privacy Choices
• Calling our Toll-Free Number: (877) 898-2905
• Emailing privacy@pingidentity.com

If you would like to designate an agent, please send an email from your own email address to privacy@pingidentity.com indicating the name and email address of your agent. We will respond to that person’s requests using both your email address and the agent’s email address.

If you are exercising CPRA access or deletion rights on behalf of another person, please understand that what will need to verify your authority with the person you seek to represent.

We will not retaliate against you if you exercise your rights under CPRA.

Ping Identity uses and discloses various categories of personal information described in our Privacy Policy.

Ping Identity uses and discloses the following categories of sensitive personal information as described in more detail in the Privacy Policy. We do not process any sensitive personal information for the purpose of inferring characteristics about you.

We do not collect non-publicly available information about (a) racial or ethnic origin, religious or philosophical beliefs or union membership (b) health, or (c) sex life or sexual orientation or the contents of mail, email or texts.

Ping Identity does not sell any personal information for monetary consideration. Some Ping Identity websites allow third party advertising partners to utilize cookies, web beacons or other technologies to deliver ads to you on our sites and to deliver our advertisements to you on other sites. These third parties may collect information about your online activities on our websites, and they may use persistent identifiers to track you over time and across different websites and other online services. You can opt-out of our sharing of your data for cross contextual behavior advertising by visiting our privacy rights portal at Your Privacy Choices. Our websites also recognize Global Privacy Control signals and will respect your opt-out request if it is provided by your browser.

Ping Identity does not offer financial incentives for the collection or sale of personal information. We may offer individuals the opportunity to receive coupons or discounts via email. If you ask us to delete your information, we will not be able to send you additional coupons or discounts via email, however coupons or discounts sent to you previously will continue to be honored according to their original terms.

In many cases, we collect personal information directly from you. We may also obtain information about you from third parties, such as recruiters, background screening companies, and platforms, such as LinkedIn. We may collect information about you automatically when you apply for a job online.

When we collect information from you about other individuals, such as people you list as references, we rely on you to obtain consent from them for the disclosures to us where required by law and to provide them with information about their rights and our privacy practices.

We only collect, use and disclose personal information when we have a legal basis for the processing. We process your personal information as needed to evaluate your job application and for other customary human resources purpose. We generally collect, use, and disclose personal information from job applicants for the following purposes:

• Evaluation of your skills, job placement,
• Hiring decisions, including negotiation of compensation, benefits, relocation packages, etc.,
• Determining an individual’s eligibility to work and assisting with work permits or visas,
• Risk management, including background checks, vetting and verification, and
• Our Everyday Business Purposes, such as
  • Identity and credential management, including identity verification and authentication, issuing badges
  • Security, loss prevention, information security and cybersecurity
  • Legal and regulatory compliance: all uses and disclosures of information that are required by law
  • To enforce our contracts and to protect Ping Identity, our workers, our clients and their employees and the public against injury, theft, legal liability, fraud or abuse, to people or property,
  • As needed to de-identify the data or create aggregated datasets, such as for reporting or analytics,
  • Making back-up copies for business continuity and disaster recovery purposes, and
  • As needed to facilitate corporate governance, including audit, analysis and consolidated reporting, mergers, acquisitions and divestitures.

This chart describes the categories of Personal Information that we collect from candidates in connection with our recruiting functions. 

In some cases, we may collect Inferred or Derived Information, such as a “success score” or “potential score.” We create inferred and derived data elements by analyzing information from your resume.  These scores can help us predict which candidates will be successful in our company.

We may also collect certain sensitive data elements, such as your race or ethnicity, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations.

If you interview with us, we may collect additional data as needed to facilitate the interview. For example, we collect Audio-visual Information if we conduct interviews using video-conferencing tools. We may collect Financial Information, of needed to reimburse you for expenses, or Health Information if you need an accommodation.  In each case, we only use and disclose the information for the purpose for which it was collected and our Everyday Business Purposes.

If we make you an offer of employment, we will also collect information needed for background screening and legal compliance, including your Government-issued Identification Number as needed for background screening (verification and/or vetting) and to document your eligibility to work.  In this case, we will handle your information in accordance with our Global Data Privacy Notice for Staff.

We collect, use and disclose sensitive personal information as needed for the purposes listed above.  We do not use or disclose sensitive personal information about our workers other than as necessary for our human resources and compliance functions and for other legally authorized purposes. We do not process any sensitive personal information for the purpose of inferring characteristics about you. 

In most cases, we only allow third parties to control the collection of personal information when those third parties are acting as a service provider or a contractor to us. These companies only retain, use and disclose your personal information in accordance with our contracts and applicable laws. However, we may receive personal information from third parties that we hire to identify candidates for us. These recruiters may collect personal information from you directly or from platforms where you have posted your biographic data such as job boards, professional organization or platforms such as LinkedIn.

We do not sell personal information pertaining to our candidates or share it with third parties for cross-contextual behavioral targeting.  We may disclose your personal information to the categories of recipients listed above in the following circumstances:

• Your personal information is shared within Ping Identity (among our affiliates) as needed to achieve the purposes set forth above. Our affiliates are all bound by our Global Privacy Policy.
• We may disclose your personal information with our data processors, service providers and contractors. These companies may only use the data as permitted by our contracts with them.
• We may also disclose your personal information as permitted by law, including (i) with your consent, such as to screening companies, (ii) as reasonably needed to protect your vital interests, such as in the event of a medical emergency or natural disaster, (iii) to our auditors and advisors, such as in connection with any internal investigations or for legal matters, and (iv) to an acquiring organization if we are involved in a sale or a transfer of some or all of our business.  We disclose personal information when required by law, including to law enforcement agencies and courts in the countries where we operate.

Ping Identity respects your rights to access, correct and request erasure or restriction of your personal data as required by law. Depending on your country or state or residence, these rights may include:

• The right to be informed about our collection, use and disclosure of your personal information.
• The right to know if we maintain your personal information, and if we do, to access that information (subject to the rights of others) and to request that we provide your information in a portable format.  
• The right to ask us to correct your information if it is incomplete or incorrect.
• The right to object to our processing of your personal information, and if we are processing your personal information based on your consent, to withdraw your consent at any time.
• The right to ask that we delete your personal information.
• California residents also have the rights to opt-out of the sale of their personal information or sharing of their personal information for cross-contextual behavior advertising, and the secondary use and disclosure of sensitive personal information.  Ping Identity does not sell or share your personal information, and we do not use or disclose your sensitive personal information other than for the purposes described above.

To exercise your rights, please visit Your Privacy Choices. You can also contact the Ping Identity Privacy Office at privacy@pingidentity.com.

Please understand that these rights are subject to some limitations. For example, we may require documentation to support certain corrections to your information, and we generally cannot restrict or delete personal information in those situations where our retention is required for our internal business purposes or to comply with law.

We will not retaliate against you if you exercise your privacy rights.

We do not use profiling techniques or make automated employment decisions that may significantly affect you, unless (1) the decision is necessary as part of a contract that we have with you, (2) we have your explicit consent, or (3) we are required by law to use the technology.  However, where permitted by law, we may use automated tools to reject job applications where the information you provide indicates that you do not meet the minimum qualifications for the job, such as having the right level of experience.  We may also automatically reject applicants if the position is filled before your application has been considered.

Ping Identity does not offer financial incentives for the collection or sale of personal information from job applicants.

We have implemented an information security program that is reasonably designed to protect the confidentiality and security of all the personal information that is entrusted to us. Our security safeguards protect against unauthorised access, improper use, alteration, destruction or accidental loss. Our service providers and data processors are contractually required to implement appropriate security controls.

We have also implemented procedures to deal with any actual or suspected data security breach and will notify you and the applicable authority about a breach as required by law.

We generally retain job applicant data for X years from the data of your application.  This retention period allows us to analyze the response to our job posting over time. We may also idenfity other opportunities within Ping Identity that might be of interest to you.  You can request that we delete your personal information by exercising Your Privacy Choices. If we do not have a legal basis for retaining your information, we will delete it.

Please note that if you are hired by us, your application data will become part of your human resources file, and subject to our Global Data Privacy Notice for Staff.

Ping Identity is headquartered in the United States. Your personal data may be transferred to, stored at or processed in a location outside the country or state of your employment which may not have equivalent privacy or data protection laws.  However, regardless of where your personal data is transferred, we will protect it in accordance with our Global Privacy Policy, this Privacy Statement and applicable law.  Where required, we use approved Standard Contractual Clauses and other approved data transfer mechanisms to assure that personal data is adequately protected.  Please contact the Privacy Office if you would like more information about cross-border transfers or to obtain a copy of any applicable Standard Contractual Clauses. 

You may contact your local human resources manager or the Ping Identity Privacy Office if you have any questions or complaints. The Privacy Office can be reached at privacy@pingidentity.com.

If you believe that we have processed your personal information in ways that are not consistent with this Privacy Notice or in violation of law, you may file a complaint with Human Resources, the Privacy Office or the Legal Department. Depending on your country of residence, you may also file a complaint with our company data protection officer (DPO). In some countries, you may also file a complaint directly with the supervisory authority.

We welcome questions and concerns!  You can always reach the Ping Identity Privacy Office via email to privacy@pingidentity.com.