Privacy Policy

We process the personal information we collect for the business objectives outlined below:

• Account creation, management, and login facilitation, including linking with third-party accounts. Legal Basis: The performance of a contract and in some cases obtaining your consent.
• Sending marketing and promotional communications in line with your preferences, with the option to opt out. Legal Basis: Your consent and our legitimate interest in promoting our services. You can withdraw your consent or opt out at any time.
• Managing orders, payments, returns, and exchanges made through our Services. Legal Basis: The performance of a contract.
• Delivering targeted advertising tailored to your interests and/or location. Legal Basis: Your consent (where required) and our legitimate interests in effective marketing.
• Requesting feedback on your use of our Services. Legal Basis: Your consent and our legitimate interest in improving our services and customer experience.
• Providing services to identify risk. Non-Customer Data Legal Basis: Legitimate interest; Customer Data Legal Basis: The performance of a contract.
• Responding to user inquiries and offering support. Legal Basis: The performance of a contract and our legitimate interest in offering effective customer service.

We may share your personal information with third-parties, for example:

• External service providers, including those offering IT and system management services, as well as centralized administrative functions.
• Vendors engaged in marketing, conducting surveys, event planning and management, data enhancement services, payment processing, data analysis, email delivery, hosting services, and customer service.
• Professional consultants, such as legal advisors, financial institutions, auditors, and insurance providers.
• Regulatory and government authorities, when we are obliged to disclose information for reporting purposes or to comply with legal requirements and judicial processes.
• In accordance with legal mandates, in response to lawful requests by public authorities, including those pertaining to national security or law enforcement requirements.
• Collaborative partners, specifically for the purpose of enabling them to assist in providing our Services to you. 
• In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Our customers, only when the data was collected from other sources, as defined in Section 1: Information Collected From Other Sources, and made available via our services for the purpose of identifying risk.

Unless described in this Policy, we do not share, sell, rent or trade any of your information with third parties for their promotional purposes. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will secure your personal information and retain it for the period we instruct. You can view an updated list of our subprocessors here: (https://sayari.com/subprocessors/).

Transferring and processing your information may involve moving your data beyond the boundaries of the European Economic Area (EEA). Under the regulations of the General Data Protection Regulation, which safeguards your personal information, we implement appropriate measures when transferring your data outside the EEA. These measures include:

• Transferring your personal information to nations recognized by the European Commission as having adequate data protection standards; or
• Engaging with our affiliates or service providers located outside the EEA, utilizing European Commission-approved Standard Contractual Clauses or other mechanisms approved by the European Commission that ensure a level of data protection comparable to that in Europe.

Should these measures not be applicable, we may seek your explicit agreement for specific data transfers. You retain the right to retract this consent at any point.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). In determining the appropriate duration for retaining data, we consider factors such as the volume, type, and sensitivity of the data, the potential risk of harm from unauthorized access or disclosure, the purposes for which we process the data, whether these purposes can be fulfilled through other means, and applicable legal obligations.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Sayari maintains a mature security and privacy program and is audited by external parties. Sayari is SOC 2 Type 2 and UK Cyber Essentials Plus compliant which demonstrates our commitment to security. Our comprehensive approach to security includes a wide array of technical and organizational measures designed to protect against unauthorized access, disclosure, alteration, or destruction of personal information. 

We have established policies and procedures to address any potential breaches of Personal Information. In the event of a breach, we will inform both you and the relevant regulatory authorities, as required by law.

Under the data protection legislation applicable to you, you may possess specific rights regarding your personal information. Depending on the laws that apply, these rights might include:

• The right to request access to your personal information.
• The right to have any inaccuracies in your personal information corrected.
• The right to erase or delete your personal information.
• The right to request a restriction on our processing of your personal information.
• The right to transfer your personal information to another controller, where feasible.
• The right to object to the processing of your personal information.

To exercise any of these rights, please submit a request here: (https://prighter.com/q/17122117530).

To confirm your identity and your entitlement to access your personal information (or to exercise any other rights), we may need specific information from you. This is a security measure to ensure that personal information is not disclosed to anyone who has no right to receive it. We may also reach out for additional information regarding your request to expedite our response.

We aim to respond to all valid requests within one month. However, for particularly complex requests or numerous concurrent requests, this period may extend beyond a month. In such cases, we will keep you informed.

If you have any concerns about how we handle your data, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence. We would appreciate the opportunity to address your concerns before you approach the supervisory authority, so please contact us first (see section 8 for more details).

You may opt out of receiving marketing messages from us or third parties at any time. You can do this by clicking the unsubscribe link in any marketing message we send, or by submitting a request here: (https://prighter.com/q/17122117530). Please note that opting out of marketing communications does not apply to personal information provided due to other transactions, like purchases.

California residents, as “consumers” under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), have specific privacy rights, barring certain statutory exceptions. These rights include accessing or deleting personal information that a business has collected, the right to correction, knowledge of, and the ability to opt-out of automated decision-making, and opting out of sharing personal information for targeted advertising. The categories of data we collect are detailed in Section 1.

Under the CCPA, you also have the right to opt out of the “sale” of your personal information. The CCPA broadly defines “sale,” which may include common data sharing practices, though transfers to service providers are not considered “sales.” California residents wishing to exercise their rights under the CCPA or CPRA to access and/or delete their personal information can submit a request here: (https://prighter.com/q/17122117530).

In relation to the personal information we process and transfer from the European Union, Switzerland, or the UK to the United States, as outlined in this Policy, we are a committed participant in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), as applicable. The Federal Trade Commission oversees our compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

In instances where this notice might conflict with the Principles of the Data Privacy Frameworks, the Principles shall take precedence. For further details on the Data Privacy Framework program and our certification, please visit https://www.dataprivacyframework.gov/s/.

For individuals in the EU, UK, and Switzerland, there is an option to seek binding arbitration in certain scenarios for complaints concerning our adherence to the Data Privacy Framework Principles, which are not resolved by other Data Privacy Framework mechanisms. Additional details can be found here: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

When we engage third parties to process personal information on our behalf under the Data Privacy Framework, these third parties must also comply with the obligations of the Framework. We accept liability for any non-compliance by these third parties, unless we can demonstrate that we are not responsible for the event leading to any incurred damages.

To exercise your privacy rights, please submit a request here: (https://prighter.com/q/17122117530).

The address and contact details of our office where Sayari is located can be found here: (https://sayari.com/contact-us/). You can contact a member of our privacy team at [email protected].

If a privacy complaint or dispute relating to Personal Data received by Sayari Labs Inc in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure. Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

Binding Arbitration

If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.

Our Services provide links to external third-party websites, plug-ins, and applications for your convenience. When you click on these links or activate these connections, third parties might collect or share your data. We do not have authority over these external sites and their privacy policies. Therefore, once you navigate away from our website, we advise you to review the privacy notices of each site you visit, as our Policy and procedures do not extend to those external websites.

Additionally, we may offer access to forums, message boards, and news groups on our Services. It’s important to be aware that any information you share in these forums becomes publicly accessible. We do not oversee the subsequent use of this information and urge you to be mindful of the data you choose to disclose. Please note that our sites, along with these message boards, chat rooms, and forums, are not designed for or targeted at individuals under the age of 18.

We may periodically update this Policy to accommodate evolving legal, regulatory, or operational needs. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We recommend that you regularly visit this page to stay informed about our current privacy practices.

Published: March 8, 2024