## Additional Information for EEA, Swiss and UK Residents The Ping Identity Privacy Policy for Consumers and Professionals (our “Privacy Policy”) provides most of the information required by the EU General Data Protection Regulation and similar data protection laws in Switzerland and the United Kingdom. However, supplemental privacy notice gives EEA Swiss and UK residents the additional information required by these data protection laws. 1 Information about Ping Identity This notice is being provided by Ping Identity Corporation and its EEA, Swiss and UK affiliates. Ping Identity 1001 17th Street Suite 100 Denver, CO 80202 USA [privacy@pingidentity.com](mailto:privacy@pingidentity.com) Ping Identity Corporation is based in the United States. Our representative in the UK is: Ping Identity UK Limited privacy@pingidentity.com We have appointed a Data Protection Officer (DPO) who can be contacted at [dpo_privacy@pingidentity.com](mailto:dpo_privacy@pingidentity.com) 2 The Purposes and Legal Basis for Processing, including Legitimate Interests Our Privacy Policy for Professionals and Consumers explains the reasons why we process your Personal Information. We only process Personal Information when we have a legal basis for the processing, such as: - To fulfill a contract with you or with your company (including providing support and service); - For closely-related purposes, such as payment processing, account management, contract management, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance; and - With your consent (or provided you have not objected, as may be applicable), to respond to requests for information and to provide you with marketing communications. We may also process your Personal Information for the purposes of our legitimate interests, provided that such processing shall not outweigh your rights and freedoms. In particular, we may process your Personal Information as needed to: - Provided you have not objected, send you our own marketing materials; - Protect you, Ping Identity or others from threats (such as security threats or fraud); - Comply with the laws that are applicable to us around the world, - Enable or administer our business, such as for quality control, analytics, consolidated reporting, and product development; - Manage corporate transactions, such as mergers or acquisitions; and - Understand and improve our business or customer relationships generally. 3 Automated Decision-Making and Profiling We may use analytics for product development purposes, such as to understand product usage, or for security purposes, such as to identify unauthorized login attempts. We will not make automated decisions about you that may significantly affect you, unless (1) the decision is necessary as part of a contract that we have with you, (2) we have your explicit consent, or (3) we are required by law to use the technology. 4 When You Are Required to Provide Personal Information to Ping Identity In most cases, you are not required by law to provide any Personal Information to Ping Identity. You are required to provide certain Personal Information to enable us to enter into a contract with you, so that you can use our products and services. Our registration forms indicate which data elements are required for our contracts. If you do not provide these data elements, we cannot do business with you. 5 ### Your Rights Ping Identity also respects your rights to access, correct and request erasure or restriction of your Personal Information as required by law. This means: - You generally have a right to know whether Ping Identity maintains your Personal Information. If we do, you have the right to request a copy (subject to the rights of others), which may be provided in a portable format. - If your information is incorrect or incomplete, you have the right to ask us to update it. - You have the right to object to our processing of your Personal Information. If we are processing your Personal Information based on your consent, you have the right to withdraw your consent at any time. - You may ask us to delete or restrict your Personal Information. You can exercise your rights by visiting [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.). If you believe that we have processed your Personal Information inappropriately, you may also contact us at [privacy@pingidentity.com](mailto:privacy@pingidentity.com). If we do not resolve your complaint, you can also contact our data protection officer or your data protection supervisory authority in your country of residence. 6 International Transfers As noted in the Ping Identity Privacy Statement, your Personal Information may be transferred to, stored at or processed in the United States and other countries which may not have equivalent privacy or data protection laws. We generally use approved Standard Contractual Clauses to assure that Personal Information is adequately protected when it is transferred out of the European Economic Area or Switzerland, but we may also make transfers to recipients with approved Binding Corporate Rules or other approved mechanism. We also participate in the US-EU and US-Swiss Privacy Shield Programs. Please see the [Ping Identity Privacy Policy](https://www.pingidentity.com/en-us/docs/legal/privacy) for additional information on our cross-border transfer safeguards. Please contact the privacy@pingidentity.com for a copy of the Standard Contractual Clauses. 7 Data Retention We will retain your Personal Information for as long as the information is needed for the purposes set forth in Section 3 above and for any additional period that may be required or permitted by law. You may request that we delete your Personal Information by exercising [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.). Unless we have a compelling interest in retaining your information, it will be deleted it within 30 days of your request. 02 ## Additional Information for California Residents The [Ping Identity Privacy Policy](https://www.pingidentity.com/en-us/docs/legal/privacy) (our “Privacy Policy”) provides most of the information required by the California Consumer Privacy Act and the California Privacy Rights Act (collectively, the “CPRA”). This supplemental privacy notice gives California residents the additional information required by the CPRA. 1 Your California Privacy Rights The CPRA provides California residents with specific privacy rights: - The right to know what personal information and sensitive personal information we collect - The right to access your personal information - The right to correct inaccurate personal information - The right to request that we delete your personal information - The right to know what categories of personal information are sold to third parties and to opt-out of that sale - The right to know what categories of personal information are shared with third parties for cross-contextual behavioral targeting and to opt-out that sharing - The right to limit the use and disclosure of sensitive personal information, and - The right not to be retaliated against for exercising your privacy rights *Personal information of children under 16 cannot be sold or shared without affirmative consent. We do not sell or share any personal information of children under 16 without affirmative consent.* If you are a California resident, you may exercise your rights by: - Visiting our privacy rights portal at [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.) - Calling our Toll-Free Number: (877) 898-2905 - Emailing [privacy@pingidentity.com](mailto:privacy@pingidentity.com) If you would like to designate an agent, please send an email from your own email address to [privacy@pingidentity.com](mailto:privacy@pingidentity.com) indicating the name and email address of your agent. We will respond to that person’s requests using both your email address and the agent’s email address. If you are exercising CPRA access or deletion rights on behalf of another person, please understand that what will need to verify your authority with the person you seek to represent. We will not retaliate against you if you exercise your rights under CPRA. 2 Additional CPRA Right to Know Disclosures Ping Identity uses and discloses various categories of personal information described in our Privacy Policy. Ping Identity uses and discloses the following categories of sensitive personal information as described in more detail in the Privacy Policy. We do not process any sensitive personal information for the purpose of inferring characteristics about you. | Category of Sensitive Personal Information | Purposes for Use and Disclosure | Can I limit this Use and Disclosure? | | --- | --- | --- | | Government-issued Identification Numbers | We use and disclose government-issued identification numbers in connection with payments made to individuals for tax reporting and compliance. | No | | Account log-in credentials | We use and disclose account access information as needed to allow you to access your account, for account security purposes. | No | | Biometric Identifiers | We use and disclose biometric identifiers for identity verification, authentication and information security purposes. | No | | Financial account numbers Payment card numbers | We use and disclose financial account and payment card numbers as needed to process transactions. | No | | Precise Geolocation Data | If you authorize our use of precise geolocation data in our mobile apps, we will use it to deliver content to you based on your location. | Yes, you can disable sharing location data with us by changing the setting on your mobile device | We do not collect non-publicly available information about (a) racial or ethnic origin, religious or philosophical beliefs or union membership (b) health, or (c) sex life or sexual orientation or the contents of mail, email or texts. 3 Sale of Personal Information and Sharing of Personal Information for Cross-Contextual Behavioral Targeting; Collection of Personal Information by Third Parties Ping Identity does not sell any personal information for monetary consideration. Some Ping Identity websites allow third party advertising partners to utilize cookies, web beacons or other technologies to deliver ads to you on our sites and to deliver our advertisements to you on other sites. These third parties may collect information about your online activities on our websites, and they may use persistent identifiers to track you over time and across different websites and other online services. You can opt-out of our sharing of your data for cross contextual behavior advertising by visiting our privacy rights portal at [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.). Our websites also recognize Global Privacy Control signals and will respect your opt-out request if it is provided by your browser. 4 Financial Incentives Ping Identity does not offer financial incentives for the collection or sale of personal information. We may offer individuals the opportunity to receive coupons or discounts via email. If you ask us to delete your information, we will not be able to send you additional coupons or discounts via email, however coupons or discounts sent to you previously will continue to be honored according to their original terms. ## Ping Identity Career Center Privacy Statement Ping Identity is committed to respecting the privacy of the individuals with whom we work. We have a Global Privacy Policy that protects all the personal information that is entrusted to us, no matter how or where it is collected, used or stored. We also comply with applicable privacy and security laws. This Privacy Statement is designed to provide you with an overview of our practices regarding the personal information we collect, use, store and, when necessary, transfer, in connection with our recruiting and hiring functions It also provides information about to access your information and exercise other privacy rights that you may have. This Privacy Statement is being provided by: Ping Identity 1001 17th Street Suite 100 Denver, CO 80202 USA 1 Sources of Personal Information In many cases, we collect personal information directly from you. We may also obtain information about you from third parties, such as recruiters, background screening companies, and platforms, such as LinkedIn. We may collect information about you automatically when you apply for a job online. When we collect information from you about other individuals, such as people you list as references, we rely on you to obtain consent from them for the disclosures to us where required by law and to provide them with information about their rights and our privacy practices. 2 General Purposes for Collecting, Using and Disclosing Personal Information We only collect, use and disclose personal information when we have a legal basis for the processing. We process your personal information as needed to evaluate your job application and for other customary human resources purpose. We generally collect, use, and disclose personal information from job applicants for the following purposes: - Evaluation of your skills, job placement, - Hiring decisions, including negotiation of compensation, benefits, relocation packages, etc., - Determining an individual’s eligibility to work and assisting with work permits or visas, - Risk management, including background checks, vetting and verification, and - Our Everyday Business Purposes, such as - Identity and credential management, including identity verification and authentication, issuing badges - Security, loss prevention, information security and cybersecurity - Legal and regulatory compliance: all uses and disclosures of information that are required by law - To enforce our contracts and to protect Ping Identity, our workers, our clients and their employees and the public against injury, theft, legal liability, fraud or abuse, to people or property, - As needed to de-identify the data or create aggregated datasets, such as for reporting or analytics, - Making back-up copies for business continuity and disaster recovery purposes, and - As needed to facilitate corporate governance, including audit, analysis and consolidated reporting, mergers, acquisitions and divestitures. 3 Specific Categories of Personal Information This chart describes the categories of Personal Information that we collect from candidates in connection with our recruiting functions. | Contact Information | | | --- | --- | | Representative Data Elements | You name, previous names and preferred names Mailing address Email address Home or mobile telephone numbers | | Sources | We collect this information from you and from recruiters. We may also obtain your information from publicly available sources, such as LinkedIn. We may use a service provider to update or standardize mailing addresses. | | Primary Purposes for Collecting | We use contact information to communicate with you by mail, email, telephone or text, such as to schedule interviews or provide status of your application. Contact information is also used to help us identify you and personalize our communications, such as by using your preferred name. | | Categories of Recipients | We disclose contact information to our affiliates, service providers, contractors and others, such as couriers and telecommunications providers. | | Candidate Information | | | --- | --- | | Representative Data Elements | Biographical data, resume or CV Data from LinkedIn profiles and similar platforms Education and degree information Professional licenses, certifications and memberships and affiliations Personal and professional skills and talents summaries (e.g., languages spoken, CPR certification status, community service participation), interests and hobbies Professional goals and interests | | Sources | We collect this type of information from you and from publicly available sources, such as LinkedIn, background screening companies, former employers and third parties that verify your credentials. We may receive information from individuals that provide you with professional references. | | Primary Purposes for Collecting | We use this information to help us understand you and your skills, to determine if you would be a good fit for the job that you applied for or other job opportunities that we may have. | | Categories of Recipients | We disclose employee information to our affiliates, service providers, contractors and others, such as travel agencies, if we schedule interviews. | | Application Information | | | --- | --- | | Representative Data Elements | Position applied for, with date of application and related data Results of any pre-employment assessments or tests Correspondence with you and others, such as recruiters, references Interview details and notes | | Sources | We collect this type of information from you and from others, such as recruiters or professional references. We may collect this information automatically, such as if you apply for a job online. | | Primary Purposes for Collecting | We use transaction information to manage our recruiting activities, to assess your qualification for the job and for internal business purposes, such as assessing overall response to our job postings. | | Categories of Recipients | We disclose transaction information to our affiliates, service providers, contractors and others, such as recruiters. | | Online & Technical Information | Please read our statement about Cookies & Online Privacy for additional information. | | --- | --- | | Representative Data Elements | IP address Data from devices that connect to our networks System logs, including access logs Records from technology monitoring programs, such as suspicious activity alerts | | Sources | We collect these data elements automatically when you interact with us online. | | Primary Purposes for Collecting | We use the online and technical information for system administration, technology and asset management, information security and cybersecurity purposes. | | Categories of Recipients | We disclose this information to our affiliates, service providers, contractors and others, such as IT and security consultants. Because some of our web pages use cookies and other third party tracking tools it is also possible that your data may be shared with third parties for cross-contextual behavioral advertising or targeting online advertising. You can opt out of this sharing by exercising Your Privacy Choices. | In some cases, we may collect Inferred or Derived Information, such as a “success score” or “potential score.” We create inferred and derived data elements by analyzing information from your resume. These scores can help us predict which candidates will be successful in our company. We may also collect certain sensitive data elements, such as your race or ethnicity, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations. If you interview with us, we may collect additional data as needed to facilitate the interview. For example, we collect Audio-visual Information if we conduct interviews using video-conferencing tools. We may collect Financial Information, of needed to reimburse you for expenses, or Health Information if you need an accommodation. In each case, we only use and disclose the information for the purpose for which it was collected and our Everyday Business Purposes. If we make you an offer of employment, we will also collect information needed for background screening and legal compliance, including your Government-issued Identification Number as needed for background screening (verification and/or vetting) and to document your eligibility to work. In this case, we will handle your information in accordance with our Global Data Privacy Notice for Staff. 4 Sensitive Personal Information We collect, use and disclose sensitive personal information as needed for the purposes listed above. We do not use or disclose sensitive personal information about our workers other than as necessary for our human resources and compliance functions and for other legally authorized purposes. We do not process any sensitive personal information for the purpose of inferring characteristics about you. 5 Collection of Personal Information by Third Parties In most cases, we only allow third parties to control the collection of personal information when those third parties are acting as a service provider or a contractor to us. These companies only retain, use and disclose your personal information in accordance with our contracts and applicable laws. However, we may receive personal information from third parties that we hire to identify candidates for us. These recruiters may collect personal information from you directly or from platforms where you have posted your biographic data such as job boards, professional organization or platforms such as LinkedIn. 6 Disclosures to Service Providers, Contractors and Other Entities We do not sell personal information pertaining to our candidates or share it with third parties for cross-contextual behavioral targeting. We may disclose your personal information to the categories of recipients listed above in the following circumstances: - Your personal information is shared within Ping Identity (among our affiliates) as needed to achieve the purposes set forth above. Our affiliates are all bound by our Global Privacy Policy. - We may disclose your personal information with our data processors, service providers and contractors. These companies may only use the data as permitted by our contracts with them. - We may also disclose your personal information as permitted by law, including (i) with your consent, such as to screening companies, (ii) as reasonably needed to protect your vital interests, such as in the event of a medical emergency or natural disaster, (iii) to our auditors and advisors, such as in connection with any internal investigations or for legal matters, and (iv) to an acquiring organization if we are involved in a sale or a transfer of some or all of our business. We disclose personal information when required by law, including to law enforcement agencies and courts in the countries where we operate. 7 Your Privacy Choices Ping Identity respects your rights to access, correct and request erasure or restriction of your personal data as required by law. Depending on your country or state or residence, these rights may include: - The right to be informed about our collection, use and disclosure of your personal information. - The right to know if we maintain your personal information, and if we do, to access that information (subject to the rights of others) and to request that we provide your information in a portable format. - The right to ask us to correct your information if it is incomplete or incorrect. - The right to object to our processing of your personal information, and if we are processing your personal information based on your consent, to withdraw your consent at any time. - The right to ask that we delete your personal information. - California residents also have the rights to opt-out of the sale of their personal information or sharing of their personal information for cross-contextual behavior advertising, and the secondary use and disclosure of sensitive personal information. Ping Identity does not sell or share your personal information, and we do not use or disclose your sensitive personal information other than for the purposes described above. To exercise your rights, please visit [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.). You can also contact the Ping Identity Privacy Office at [privacy@pingidentity.com](mailto:privacy@pingidentity.com). Please understand that these rights are subject to some limitations. For example, we may require documentation to support certain corrections to your information, and we generally cannot restrict or delete personal information in those situations where our retention is required for our internal business purposes or to comply with law. We will not retaliate against you if you exercise your privacy rights. 8 Automated Decision-Making and Profiling We do not use profiling techniques or make automated employment decisions that may significantly affect you, unless (1) the decision is necessary as part of a contract that we have with you, (2) we have your explicit consent, or (3) we are required by law to use the technology. However, where permitted by law, we may use automated tools to reject job applications where the information you provide indicates that you do not meet the minimum qualifications for the job, such as having the right level of experience. We may also automatically reject applicants if the position is filled before your application has been considered. 9 Financial Incentives Ping Identity does not offer financial incentives for the collection or sale of personal information from job applicants. 10 Information Security We have implemented an information security program that is reasonably designed to protect the confidentiality and security of all the personal information that is entrusted to us. Our security safeguards protect against unauthorised access, improper use, alteration, destruction or accidental loss. Our service providers and data processors are contractually required to implement appropriate security controls. We have also implemented procedures to deal with any actual or suspected data security breach and will notify you and the applicable authority about a breach as required by law. 11 Data Retention We generally retain job applicant data for X years from the data of your application. This retention period allows us to analyze the response to our job posting over time. We may also idenfity other opportunities within Ping Identity that might be of interest to you. You can request that we delete your personal information by exercising [Your Privacy Choices](https://preferences.pingidentity.com/?_gl=1*1o4jf1n*_gcl_au*MjAzNTM3NjMzMC4xNzgyMTUwNDQ0*_ga*MTQ3MTY1NzU1MC4xNzc0MzY1NjAx*_ga_V94KKVLZPT*czE3ODc5NDc4NzckbzIzMiRnMSR0MTc4Nzk0ODQ5OSRqMzYkbDAkaDE3NTkxMTMyMjM.). If we do not have a legal basis for retaining your information, we will delete it. Please note that if you are hired by us, your application data will become part of your human resources file, and subject to our Global Data Privacy Notice for Staff. 12 International Transfers Ping Identity is headquartered in the United States. Your personal data may be transferred to, stored at or processed in a location outside the country or state of your employment which may not have equivalent privacy or data protection laws. However, regardless of where your personal data is transferred, we will protect it in accordance with our Global Privacy Policy, this Privacy Statement and applicable law. Where required, we use approved Standard Contractual Clauses and other approved data transfer mechanisms to assure that personal data is adequately protected. Please contact the Privacy Office if you would like more information about cross-border transfers or to obtain a copy of any applicable Standard Contractual Clauses. 13 Questions or Complaints You may contact your local human resources manager or the Ping Identity Privacy Office if you have any questions or complaints. The Privacy Office can be reached at [privacy@pingidentity.com](mailto:privacy@pingidentity.com). If you believe that we have processed your personal information in ways that are not consistent with this Privacy Notice or in violation of law, you may file a complaint with Human Resources, the Privacy Office or the Legal Department. Depending on your country of residence, you may also file a complaint with our company data protection officer (DPO). In some countries, you may also file a complaint directly with the supervisory authority. 14 How to Contact the Privacy Office We welcome questions and concerns! You can always reach the Ping Identity Privacy Office via email to [privacy@pingidentity.com](mailto:privacy@pingidentity.com).