Data Protection and Privacy Policy Statement

This Privacy Policy describes how Monsido collects, uses, shares, and secures your Personal Data when you access our Website (monsido.com) or our Monsido Platform interface (app.monsido.com), use our Services (defined below), or otherwise interact with us. This Privacy Policy contains an explanation of your rights regarding Monsido’s use of your Personal Data and how we communicate with you.

Monsido attaches great importance to ensuring that your personal data is collected, used, stored, and erased in accordance with the current applicable regulations as stipulated by local, state, national, federal, and other data protection legislation. Protecting your data is a matter of great importance to our company. If you have requests concerning your personal information or any questions, please contact us privacy@monsido.com.

Monsido makes available this Privacy Policy in compliance with its role as a data controller, as that role is defined by relevant legislation. This means that it applies to when Monsido collects, uses, shares, and processes data at a non-application level.

This Privacy Policy does not apply to the extent we are acting as a Customer’s data processor. To learn more about our processing activities as a data processor when rendering our software-as-a-service offering, please see the relevant documentation on our Compliance page or refer to your Customer Data Processing Agreement. This Privacy Policy also does not apply to Monsido’s human resources activities (recruiting and employment) or to our vendor- related activities when we are acting as a data controller. For more information on such activities, please refer to our Employee Privacy Policy posted on Monsido’s Internal Knowledge Base or as otherwise made available to you during our recruitment and due diligence processes.

We base our corporate definition of “data controller” and “data processor” on those set forth in the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation (“GDPR”)). We use the GDPR framework as our standard as Monsido originated in the European Union (Denmark) and is from where its Monsido Platform continues to be developed.

In addition to the GDPR, Monsido also complies with the Retained Regulation (EU) 2016/679 (“UK GDPR”) and the Data Protection Act 2018 (DPA 2018); Act 199 of 1988, Australian Privacy Act of 1988 and its Australian Privacy Principles (“APP”); California Consumer Privacy Act of 2018, as amended; and various other data protection and cybersecurity regulations to which Monsido may be bound. For more information for our U.S. state law privacy compliance, see our Notice at Collection.

Monsido operates globally, with each office acting as a data controller in the following circumstances:

• Monsido ApS (Borupvang 3, 2750 Ballerup, Denmark): International Marketing; Website provision; EEA/Swiss Sales; Product-related activities; Development; Security
• Monsido LLC: North America Sales
• Monsido LTD: United Kingdom and Wales, Ireland Sales
• Monsido PTY Ltd: Australia and Asia-Pacific Sales

We also act as a co-data controller with our parent company, U.S.-based CivicPlus, LLC, pursuant to Standard Contractual Clauses and in the following circumstances: Global customer invoicing; Finance; Legal; Compliance; and US marketing. Please refer to the CivicPlus Privacy Policy for more information about how CivicPlus collects, uses, shares, and secures Personal Data.

Finally, end Users of our Monsido Platform are asked to please note Monsido also collects Personal Data on behalf of our Customers in accordance with our Customers’ specific instructions, such as pursuant to a Data Processing Agreement. If you are an employee or contractor of a Monsido Customer and have questions about how our Customer has instructed us to collect, use, store, process, or otherwise handle your Personal Data, you should contact the Customer directly. Customers maintain their own privacy practices concerning the collection, use, storage, processing, and handling of their end-users' Personal Data and should be the first point of contact if making a data subject access request.

For purposes of this Privacy Policy the following definitions are applied:

References to “Customer” mean a company, agency, or other business or governmental or non-government agency with which Monsido is entering into sales discussions for the Monsido Platform and/or with which executed a contract to provide its Monsido Platform.

References to “Customer Website” mean those publicly available pages of Customer’s website that are scanned by the Monsido Platform as part of the Monsido service offering.

References to a “Data Subject” mean a User on whom we have collected, used, processed, shared, or otherwise received and handled Personal Data as the term “data subject” is defined by the GDPR.

References to the “Monsido Platform” mean the software-as-a-service platform accessible by Users who are Customer end users and available through https://login.monsido.com/.

References to “Personal Data” mean any data that could, directly or indirectly, be used to identify a User as personal data, personal information, or personally identifiable data or information may be defined by relevant law.

References to the “Services” means those software-as-a-service modules provided to our Customers who have executed a contract to provide such services, including the ability to set up, access, and manage the same through the Monsido Platform.References to “us,” “we,” “our,” and/or “Monsido” means the Monsido corporate entities set forth in this Privacy Policy in the section titled “Monsido’s Role as a Data Controller.”

References to the “Website” mean, collectively, the websites bearing the URLs www.monsido.com and app.monsido.com.

References to “you,” and/or “User,” mean a user of the Website, an end user of the Monsido Platform or representative of a Customer, or an individual who has interacted with Monsido, such as by signing up for our mailing list, attending a Monsido webinar, or emailing Monsido.

By accessing the Website or the Monsido Platform, using our Services, or otherwise interacting with us, you represent that you have read and understood the Privacy Policy and that you agree to be bound by it.

This Privacy Policy may be additionally subject to our Terms of Service and Data Processing Agreement for those Customers who have registered for our Services as well as our Cookie Policy and General Website Terms and Conditions for Users of our Website.

We may modify, add to, suspend or delete the Privacy Policy, in whole or in part, at our sole discretion at any time, with such modifications, additions, or deletions being effective thirty (30) calendar days following their posting to the Website and emailing of a notice to Users for whom we have an email address. Your access of the Website, use of our Services, or continued interaction with us after such modification, addition, or deletion of the Privacy Policy shall be deemed to constitute acceptance by you of such changes.

We collect both personally identifiable data and non-personally identifiable data. Often, you choose what information to provide to us, but, sometimes, we may require certain information for you to use and for us to provide the Services, the Website, the content you have requested from us, or to otherwise interact with us. We collect Personal Data directly from Users, from our Customers, automatically from Users (such as through interactions with our Website,) and from lead sources (where allowed by relevant law). More details can be found below on the source of Personal Data, why Personal Data is collected, what is collected, and our basis for processing Personal Data.

We believe in the principle of data minimization and so always try to collect the minimal amount of Personal Data necessary to make our Services, Website, and business function.

A. Personal Data You Provide To Us

We collect the Personal Data you directly provide to us and use it in the following ways:

B. Personal Data We Collect In Connection With Our Services

We collect Personal Data in connection with our Services and use such Personal Data in the below ways. Monsido does not offer its Services to consumers, and, therefore, to the extent that it collects a User’s Personal Data from a Customer or a representative of a Customer, Monsido relies on the representations of the Customer that the Customer has the lawful authority to have collected and provided such Personal Data to Monsido, for example, pursuant to an employment contract between the User and Customer.

Please note: This Privacy Policy does not apply to the extent we are acting as a Customer’s data processor. To learn more about our processing activities as a data processor, please see the relevant documentation on our Compliance page or refer to your Customer Data Processing Agreement.

3. Personal Data We Automatically Collect From Users Of Our Website And Monsido Platform

We collect Personal Data automatically from Users of our Website and Monsido Platform. We use this Personal Data in the below ways:

4. Personal Data We Collect From Third Parties

We may collect Personal Data regarding Users from third parties and other websites, depending on local rules and regulations regarding collection of Personal Data from third parties. Depending on the jurisdiction where a User is located, the following may or may not be applicable as we seek to ensure compliance with all relevant regulations that affect our Users. We use this Personal Data in the below ways:

Monsido does not collect any special category or sensitive data, for example, we do not collect health data, financial data, racial identity data, religious data, or any other data attributable to a single User that may be considered sensitive.

Monsido may share your Personal Data with its related corporate entities. We may also share your Personal Data with third parties in the ways described below. We will never sell Personal Data of our Users. For more information regarding how we comply with US state laws on the selling and sharing of User Personal Data, please see our Notice at Collection.

You have certain rights regarding your Personal Data, depending on your country of residence. Below is a summary of those rights. California Users are directed to Monsido’s Statement at Collection for a summary of their rights under state law, which may differ from those set forth below.

Sometimes, your rights may be limited, such as when honouring a request would reveal information about another person or if you request we delete Personal Data that we are permitted that we are permitted by law or our legitimate interests to keep.

We are required to verify the identity of any User exercising a Personal Data right. This identification process may require providing us with a signed declaration confirming your identity. If a request is made on behalf of a User by a third party, we require a certification from the User that we can provide such third party the User’s Personal Data. We reserve the right to deny any request where we do not reasonably believe the identity of the User or authorization for such a request has been provided to us.

We will respond to any request in a timely manner, which in most instances will be thirty (30) days. The time to respond to requests is set out in relevant law and may differ, depending on where the User resides.

1. Right to be Informed. You have the right to be informed about Monsido’s data collection processes. We fulfil this right by providing you with this Privacy Policy, including at the time of Personal Data collection.
2. Right of Access. You have the right to access what Personal Data Monsido has collected about you. You can exercise this right by making a Data Subject Access Request.
3. Right to Rectification. You have the right to ask Monsido to correct any Personal Data it holds about you so as to ensure your Personal Data is accurate. You also have the right to ask Monsido complete incomplete Personal Data held about you. Oftentimes, you can rectify your Personal Data yourself through the account settings in the Monsido Platform. You can also correct any incorrect Personal Data by emailing us at privacy@monsido.com or by using one of our support channels.
4. Right to Restrict Processing. You have the right to restrict Monsido’s processing of your Personal Data where: you have contested the accuracy of the Personal Data; you have objected to the processing and Monsido is considering whether it has a legitimate ground which overrides this objection; the processing is unlawful; or Monsido no longer requires the Personal Data but you require that Monsido does not delete it so as to establish, exercise or defend a legal claim you may have. To exercise your right to restrict processing, please email us at privacy@monsido.com. A User may also contact the User’s relevant Customer to discuss the User’s desire to restrict processing where such processing relates to Personal Data provided by said Customer or processed on the basis of contract with said Customer.
5. Right to Erasure. In some circumstances, you have the right to ask that your Personal Data be deleted: your Personal Data is no longer necessary in relation to the purpose for which it was collected/processed by Monsido; you withdraw your consent or object to the processing and there is no overriding legitimate interest to continue processing; you object to the processing and there are no overriding legitimate grounds for the processing; you object to the processing and your Personal Data was processed for direct marketing purposes; your Personal Data was unlawfully processed or should be erased to comply with a legal obligation; or your Personal Data is processed in relation to the offer of information society services to a child.
   Please note, that Monsido may refuse your request to delete your Personal Data if an exception applies: to comply with a legal obligation or for the performance of a task of public interest; for the exercise or defence of legal claims; or for purposes relating to public health, archiving in the public interest, scientific/historic research or statistics.
   If your Personal Data has been disclosed to a third party, Monsido will ask it to erase that data, unless this proves impossible or involves disproportionate effort. You may ask who those third parties are by making a Data Subject Access Request, and Monsido or the relevant Customer, as applicable, will inform you accordingly.
   To exercise your right to erasure, please email us at privacy@monsido.com. A User may also contact the User’s relevant Customer to discuss the User’s desire to be forgotten where such processing relates to Personal Data provided by said Customer or processed on the basis of contract with said Customer.
6. Right to Data Portability. You have the right to move, copy, or transfer your Personal Data from one IT environment to another in a safe and secure way, without hindrance to usability. This enables you to obtain and reuse your Personal Data across different services. This being noted, due to the nature of the Services Monsido provides and the types of data it collects, the right to data portability, although it exists, any Personal Data we provide to you in response to your exercise of this right may be limited in its utility. This right applies to Personal Data that you have personally provided to Monsido (see above section “The Personal Data You Provide to Us”); where our processing is based on consent or the performance of a contract; and where processing is carried out by automated means. You may make a request for data portability by making a Data Subject Access Request.
7. Right to Object. You have the right to object to Monsido’s processing of your Personal Data in certain circumstances. You also have the right to stop your Personal Data being used for direct marketing. You can also object to Monsido’s processing of your Personal Data if the processing is for: a task carried out in the public interest; is done in the exercise of an official authority vested in Monsido; or is done for Monsido’s legitimate interests (or those of a third party). However, in these circumstances the right to object is not absolute, and you must give specific reasons why you are objecting to the processing of your Personal Data. Even if an objection is made, Monsido will continue to process your Personal Data if: Monsido can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the objecting User; or the processing is for the establishment, exercise or defence of legal claims.
   To exercise your right to object to processing, please email us at privacy@monsido.com. A User may also contact the User’s relevant Customer to discuss the User’s objection where such processing relates to Personal Data provided by said Customer or processed on the basis of contract with said Customer.
8. Right Not to Be Subject to Automated Decision Making or Profiling. You have the right not to be subject to fully automatic decisions (those without human intervention in the decision-making process) that may have legal effects or which would significantly affect you. You also have the right not to be profiled, which is any form of automated processing of your Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to you, in particular to analyse or predicts aspects concerning your performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements. At present, Monsido does not use any fully-automated decision making or profiling systems, and, therefore, this right cannot be exercised. However, Monsido may use such automated decision-making in the following circumstances: where we have notified you of the decision and given you 21 days to request a reconsideration; or where it is necessary to perform the contract and appropriate measures are in place to safeguard your rights.

Where we collect or process your Personal Data based upon consent, you may revoke consent. Please note, if you revoke your consent for the processing of Personal Data, we may no longer be able to provide you Services.

You may control the receipt of certain types of communications from Monsido. Monsido may contact you by phone or email about the Services or your activity. Some of these communications are required, Service-related messages for Users of our Monsido Platform, such as transactional communications or legal notices. Other communications are not required, such as newsletters and direct marketing, as discussed below. We will never shareyour email with a third party for its own marketing purposes, unless you have given us your consent to do so.

We operate an email newsletter program, used to inform subscribers about products and services supplied by us or our third-party affiliates, news that may affect our Customers and Users, and upcoming event announcements. Subscription to our newsletter is opt-in. Users can opt-out of receiving our newsletter at any time by following the unsubscribe link contained in the footer of any newsletter or by emailing us at privacy@monsido.com. Please note that for current Customers or Customers with whom we are in contract negotiations, your consent to receive direct marketing from Monsido is assumed; however, you may opt- out of receiving such direct marketing at any time and such opt-out will be respected.

Email marketing campaigns published by us may contain tracking facilities within the actual email. Subscriber activity is tracked and stored in a database for future analysis and evaluation. Such tracked activity may include the opening of emails, forwarding of emails, the clicking of links within the email content, times, dates, and frequency of activity. This information is used for Monsido’s and the User’s legitimate interest to refine future email campaigns and supply the User with more relevant content based around the User’s activity. If you do not agree with the use of such tracking, please unsubscribe from our newsletter or otherwise withdraw consent using one of the methods set out in this Privacy Policy.

Please note that while you may have the opportunity to opt-out of our marketing email list as discussed in the “How to Opt-Out” section above, and you may be able to control the use of cookies through your Web browser as described in the “Use of Cookies” section below, some Web browsers may also give you the ability to enable a “do not track” setting. This setting sends a special signal to the websites you encounter while Web browsing. This “do not track” signal is different from disabling certain forms of tracking by declining cookies in your browser settings, as browsers with the “do not track” setting enabled still have the ability to accept cookies. We do not respond to Web browser “do not track” signals at this time. If we do so in the future, we will describe how we do so in this Privacy Policy. For more information about “do not track,” visit http://www.allaboutdnt.org/.

Our Website and the Monsido Platform may contain links to other websites, which are outside our control and are not covered by this Privacy Policy. If you access other websites using the links provided, the operators of these websites may collect Personal Data from you, which will be used by them in accordance with their privacy policies. These policies may differ from ours.

To enhance your online experience, we may use “cookies” or similar technologies. Please see our Cookie Policy, available online at https://monsido.com/cookie-policy/ regarding our use of cookies and how to opt-out of online tracking. Please note that if you change browsers or computers, or if you clear your browser’s cache, you may need to click the link again to apply your preferences.

Protecting children’s privacy is important to us. For that reason, we do not collect or maintain Personal Data of those persons we actually know are under the age of thirteen (13) nor is any part of the Website, Monsido Platform, or our Services targeted to attract anyone under the age of thirteen (13). We request that all users of the Website, Monsido Platform, and our Services who are under the age of thirteen (13) not disclose or provide any Personal Data. If we discover that a child under thirteen (13) has provided us with Personal Data, we will delete that child’s Personal Data from our records. You are responsible for any and all account activity conducted by a minor under your account.

In addition to protecting the privacy of children under the age the age of thirteen (13), we are committed to protecting the privacy of minors. Though our Website, Monsido Platform, and Services are not targeted to minors, nor are they it intended to be used by minors, if for any reason a minor has shared Personal Data with us, said minor may request and obtain removal of such information by contacting us at privacy@monsido.com.

Monsido will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. This may include for as long as your account is active for Users of the Monsido Platform, for the term of contract where you are a designated representative of a Customer, or for those other purposes as described in this Privacy Policy. If you no longer want Monsido to use your Personal Data, you may exercise your right of deletion; however, as accounts are provided in accordance with our contract with a Customer, Users who wish to close their accounts should first speak with the relevant Customer regarding their desires to be removed as an end user or as a Customer point of contact for sales, marketing, legal, and/or compliance purposes. Monsido will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your information to comply with applicable tax/revenue laws), resolve disputes, and enforce our agreements. The period for which are required to retain Personal Data for these purposes is set by law and is jurisdictionally dependant. We also retain log files for internal analysis purposes. These log files are generally retained for a brief period of time, except in cases where they are used for the safety and security of our Monsido Platform and/or Website, to improve the functionality of our Website, Monsido Platform, or Services, or we are legally obligated to retain them for longer time periods.

We take steps to maintain the security of the Personal Data that we collect, including have implemented additional safeguards for the Personal Data of our EEA/UK/Swiss customers. We also closely evaluate our third-party processors and those companies with whom we share Personal Data to ensure compliance with relevant data processing laws. For more information about our security practices, please see Information Security Overview.

Please note that no service is completely secure. While we strive to protect your Personal Data, we cannot guarantee that unauthorized access, hacking, data loss or a data breach will never occur. If we are required by law to inform you of a breach to your information, we may notify you electronically, in writing, or by telephone. For Users who are Customer end Users or authorized contact points, such notification may come from the relevant Customer.

Monsido operates globally and has offices in the United Kingdom, Denmark, Australia, and the United States. For registered Customers with whom Monsido has a data processing agreement, all Customer data is stored on geo-located servers in compliance with applicable local data protection laws and Monsido’s contractual commitments to its Customers when acting as a data processor. For more information about international data transfers for Customer data at an application-level and when Monsido is acting as a data processor, please see our Transfer Risk Impact Statement.

In addition, due to the international nature of our company, we may have to transfer User Personal Data to our related corporate bodies, affiliates, contractors, service providers, and other third parties in countries around the world. When we make such transfer, we rely on appropriate safeguards to ensure Personal Data remains protected and otherwise comply with relevant data transfer regulations.

Transfers from the EEA/UK/Switzerland. We may transfer Personal Data worldwide in order to support our global operations. Users located in the European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland, should please note some of the countries that we transfer, store, and process information in may not have privacy and data protection laws that are equivalent to the laws of the country where the User is located. When this is the case, we utilize the European Commission Standard Contractual Data Protection Clauses and the United Kingdom Standard Contractual Data Protection Clauses to safeguard the transfer of information we collect from Users located in the EEA, the UK, and Switzerland to third countries. Monsido is fully committed to the principles of the UK and EU GDPR, including when it comes to international data transfers. To learn more about our commitment to the GDPR, please see https://monsido.com/gdpr.

Participation in the EEA/Swiss Data Privacy Framework Program. As a global company, Monsido recognizes that its Users may have concerns not just about the access of Monsido’s processors to Personal Data but also about the access of Monsido’s related corporate bodies, including its U.S.-based parent company, CivicPlus, LLC, to Personal Data. Monsido is committed to operating is Services and data collection activities independently and does not share processing activities for its Services with its parent company when fulfilling its role as adata processor pursuant to a Customer contract. For more information about Monsido’s commitment to independence, please see our Statement on Schrems II and Data Sovereignty Statement.

Where Monsido acts as a data controller, it may share Personal Data of Users located in the EEA, UK, or Switzerland with its related corporate entities and transfer such data from the EEA, UK, or Switzerland to the United States and other countries. When we transfer Personal Data, we rely on Article 45 of Regulation (EU) 2016/679 (GDPR) and UK Secretary of State, based on Article 45 of the UK GDPR and Section 17A of the Data Protection Act 2018 or the EC’s Standard Contractual Clauses (“SCCs”) and the UK Information Commissioner’s Office’s International Data Transfer Addendum (“IDTA”), as applicable, supplemented by additional security measures as recommended by the European Data Protection Board. The European Commission and the UK’s Information Commissioner’s Office ("ICO”) have determined that the SCCs and IDTA may provide sufficient safeguards to protect Personal Data transferred outside the EEA, UK, and Switzerland. Where we transfer Personal Data, we perform transfer impact assessments (“TIAs”) and continually monitor the circumstances surrounding such transfers to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the EEA, UK, and Swiss data protection laws.

In addition to utilizing SCCs, as part of our commitment to maintaining high data protection standards when transferring Personal Data between the EEA/UK/Switzerland and the United States, we plan to participate in the EU-US/Swiss-US Data Privacy Frameworks and the UK Extension to the same (collectively “EU/SWISS-US DPF.”) We will certify to the Federal Trade Commission that we adhere to the EU/SWISS-US DPF Principles (“EU/SWISS-US DPF Principles”) with regard to the processing of Personal Data received from the European Union in reliance on the EU/SWISS-US DPF. If there is any conflict between the terms in our Privacy Policy and the EU/SWISS-US DPF Principles, the Principles govern. To learn more about the Data Privacy Framework (“DPF”) program please visit https://www.dataprivacyframework.gov/.

In compliance with the EU/SWISS-US DPF Principles, we have committed to resolve complaints about privacy and our collection or use of User’s Personal Data transferred to the United States pursuant to the EU/SWISS-US DPF Principles. EEA/SWISS individuals with DPF inquiries or complaints should first contact Monsido: Data Protection Officer, privacy@monsido.com. We will investigate and attempt to resolve any complaints or disputes regarding processing of personal data within forty-five (45) days of receiving a privacy complaint.

Monsido is further committed to refer unresolved privacy complaints under the EU/SWISS- US DPF Principles to an independent dispute resolution mechanism, Cybersecurity and Privacy Practice Group, operated by JAMS. If a User does not receive timely acknowledgment of a complaint, or if a complaint is not satisfactorily addressed, we invite a User to visit the JAMS Program for more information and to file a complaint. This service is provided free of charge to our Users.If an EU/SWISS-US DPF complaint cannot be resolved through the above channels, under certain conditions, our User may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. Through CivicPlus, we are subject to the jurisdiction of the US Federal Trade Commission for the purposes of EU/SWISS-US DPF enforcement.

If an EU/SWISS-US DPF complaint cannot be resolved through the above channels, under certain conditions, our User may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. Through CivicPlus, we are subject to the jurisdiction of the US Federal Trade Commission for the purposes of EU/SWISS-US DPF enforcement.

Monsido understands privacy and data protection is a critical concern for its customers, and we have listened to our international customers and sought to ensure that, no matter our global reach, we design our products and operational landscape to reflect the principles of privacy by design and privacy by default, while also ensuring compliance with the various data protection regulations that govern our offices. We believe that our Users should control who has access to their Personal Data and oppose any request by law enforcement or surveillance agencies to obtain the data of our EEA and UK Users. Unless prohibited by law, we will always notify a User of any such request for the User’s Personal Data so as to allow the User the opportunity to object to the request. We publish annual Transparency Reports regarding such requests.

We will not discriminate against individuals who exercise their privacy rights under applicable law. However, the exercise of some rights may result in our inability to provide a User with access to the Website or Monsido Platform or to otherwise continue rendering Services.

This Privacy Policy can be accessed using your browser’s audio reader capabilities. Please see our Accessibility Statement for more information.

We may display personal testimonials from satisfied Customers who have given us their permission to do so and other endorsements on our Site. If you are the authorized representative of a Customer, where a Customer has given us permission, we may post a User photograph, name, and title together with a testimonial. Where we do so, we base our processing on the representation from our Customers that they have your consent to do so and have given us this consent. If you wish us to update or delete your testimonial, please contact us at privacy@monsido.com.

We consider answers to surveys, comments, ideas, and suggestions to be non-personal and do not classify them as Personal Data. Except as otherwise provided by applicable contracts with our Customers or a third party, we are free to disclose and use such data or information without any obligation.

If you have any questions or concerns about our Privacy Policy or its implementation you may contact us: at privacy@monsido.com.

Or you may write to us at Monsido ApS, Attn: Data Protection Officer, Borupvang 3, Ballerup, DK-2750, Denmark.

Without prejudice to any other rights you may have, if you are located in the EEA/UK/Switzerland, you also have the right to file a complaint against Monsido with the Danish Data Protection Commissioner ("Datatilsynet"), which is Monsido’s Lead Supervisory Authority. The DPC’s contact details are:

Office of the Data Protection Commissioner
Datatilsynet
Borgerade 29, 5
DK-1300 Copenhagen K.
Fax: +45 33 19 32 18
Email: dt@datailsynet.dk
Digital post: www.borger.dk

If you live in the EEA/UK/Switzerland, you may also file a complaint with your local data protection regulator.

This Privacy Policy was last updated on July 20, 2023, to include more detailed information about from where we collect Personal Data, our bases of processing, our commitment to U.S. state laws regarding privacy policy, and our plan to participate in the EU/SWISS-DPF program and available redress resources, among other changes.

Click here to download a PDF version of this Privacy Policy.

We provide the following U.S. CCPA & State Privacy Notice – Notice at Collection for Users located in California and other states which may have privacy regulations. To the extent of a disagreement between the main terms of the forgoing Privacy Policy and this Notice at Collection, this Notice at Collection will control.

• Accountability so that you know Monsido holds itself accountable to its Customers and Users who entrust it with Personal Information
• Transparency so that you know what Personal Information we collect, use, disclose, share, and sell
• Control so that you can contract how your Personal Information is accessed, corrected, and deleted

• As necessary or appropriate to protect the rights, property or safety of us, our Customers, Users, or others;
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations; or
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

• Category A: User Identifiers
• Category B: Customer Records
• Category C: Characteristics of Protected Classifications Under California or Federal Law
• Category D: Commercial Information
• Category F: Internet or other Electric Network Activity Information
• Category G: Geolocation Data
• Category H: Audio, electronic, visual, thermal, olfactory, or similar information
• Category I: Professional or Employment-Related Information

• The categories of Personal Information we have collected about you;
• The categories of the sources from which the Personal Information was collected;
• The Categories of third parties to whom we disclosed your Personal Information; the categories of Personal Information that were disclosed; and the purpose for disclosing the Personal Information; and
• The Personal Information we collected about you.

1. Writing us at: Monsido, LLC, Attn: Data Protection Officer, 302 S. 4th Street, STE 500, Manhattan, Kansas, 66502
2. Emailing us at privacy@monsido.com