Privacy Policy

Effective August 31, 2023

Welcome to Dromo! This Privacy Policy explains how we collect, store, use, and disclose ("process") your information when you interact with our services. This policy applies to our website, applications, software, products, and any other services we offer (collectively, the "Service" or "Services").

The Privacy Policy supplements our Terms of Service, available at https://dromo.io/legal/terms, which govern all use of the Service.

• Visitor: If you're browsing the Site without an account, you're a Visitor.
• Customer or Account Holder: If you've made an account with us, you're a Customer.
• End User: If you're using a Service that requires a Dromo license key, you're an End User.

We may collect and process your information, including personal data, when you:

• Visit our website, including any subdomains like developer.dromo.io.
• Upload data using our Services.
• Engage with us in other ways, like attending events or personal communication.

This policy only applies to personal information.

It also does not apply to any data collected from or about End Users. For information on how Dromo handles End User Data and End User Metadata, see https://dromo.io/legal/terms#end-user-data.

For any questions or concerns, please contact us at privacy@dromo.io.

When you sign up, use our Service, or get in touch with us, you may provide personal details like:

• Names
• Email and mailing addresses
• Phone numbers
• Job titles
• Usernames and passwords
• Payment information

Please make sure all the information you provide is accurate and up-to-date.

When you use our Service, we automatically gather data such as:

• Transaction details if you buy or cancel a service
• Technical info like your IP address, device type, and browser
• Usage stats like which pages you visit and features you use

We also use cookies to collect data about how you use our Service. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice, available at https://dromo.io/legal/cookies.

We may get additional data about you from public records, partners, and social media. This can include things like your job title and social media profiles.

If you sign up using a third-party account like Google or Github, we collect information based on your account settings on those platforms.

We don't knowingly collect sensitive information.

By using our Service, you agree to us collecting this information. Make sure to check your social media settings for control over what information is shared.

We follow GDPR rules and only process your personal information if we can satisfy at least one of the following legal bases:

• Consent: You've given us permission. You can take it back anytime.
• Legitimate Interests: It's necessary for our business.
• Contract: It's needed to give you our services.
• Legal Obligations: We have to for legal reasons.
• Vital Interests: It's crucial for someone's safety.

We use your information if we have either:

• Express Consent: You've clearly given us permission; or
• Implied Consent: It's reasonable to assume you've given permission.

You can withdraw your consent at any time.

Exceptions

In rare cases, we might use your information without consent, as specified under Canadian law:

• Urgent Situations: Like fraud detection or emergencies.
• Legal Requirements: Such as court orders.
• Business Transactions: Under specific conditions.
• Other Reasons: Like journalism or public information.

Account Management. We use your info to create and manage your account. If you link to third-party accounts like Google or Github, we use that info to help you log in.

Service Delivery. We use your data to provide and improve our services, including troubleshooting and personalization.

Customer Support. We use your info to answer your questions and solve issues you may have with our service.

Order Management. We handle your orders, payments, and returns using your information.

Security. We use your data to keep our services safe and secure, like for fraud prevention.

Feedback. We may ask for your feedback about our services.

Administrative Updates. We'll send you important updates and notices about our services.

Promotions. With your consent, we'll send you info about new features and offers.

Advertising. We may show you ads based on your data, following legal requirements for consent.

Public Contributions. If you share content meant for public display, we'll use it as you intend.

Testimonials. With your consent, we may post your testimonials on our site. You can update or remove them by contacting us.

Legal Obligations. We use your data to meet legal requirements and respond to legal requests.

Safety Measures. In emergencies, we may use your data to protect someone's safety.

We may combine data from different sources to improve your experience with us.

We share your data with companies that help us run our services. This can include payment processing, customer support, and more. Some of these providers may be outside the U.S. or EU but they comply with relevant laws.

A list of subprocessors is included at https://dromo.io/legal/subprocessors.

We may share your data to:

• Protect you and others from harmful activities like fraud.
• Keep our services secure.
• Defend our legal rights.

We will share your data with authorities if we are legally required to do so.

If our business gets sold or merged, we may transfer your data to the new owners.

We don't sell your personal data for money. We may share anonymous data as allowed by law.

Our servers are in the U.S. If you're using our services from outside the U.S., your data will be sent to and stored in the U.S.

Where valid, we rely on Standard Contractual Clauses (SCCs) for transferring data from the EU. These are agreements that help ensure your data is secure when it leaves the EU.

To learn more or request a copy of our SCCs, contact us at privacy@dromo.io. Please indicate in the email if you require Module 2 (controller-to-processor) or Module 3 (processor-to-processor), and whether you require an international data transfer addendum (IDTA) for transfers out of the UK.

We keep your information only as long as needed for the reasons stated in this Privacy Policy, or as required by law. The length of time can vary based on factors like legal requirements or how sensitive the data is.

Once we don't need your data anymore, we'll either delete it or make it anonymous. If we can't do that right away (like if your data is in a backup), we'll keep it secure until we can delete it.

We don't knowingly collect data from kids under 13. By using our service, you confirm you're 13 or older, or that you're the parent or guardian giving consent for a minor under 13. If we find out we've collected data from someone under 13, we'll delete it.

If you know of any data we've collected from kids under 13, please contact us at privacy@dromo.io.

If you've given us permission to use your data, you can take it back anytime. This won't affect past use of the data.

To change or delete your account:

• Update settings in your account, or
• Contact us directly.

• You can set your browser to reject cookies, but it might affect the service.
• You may manage your Dromo-specific cookie choices from the Cookie Consent Manager that appears on the first visit to our Site, and is accessible from a link in the footer afterwards.
• To opt out of targeted ads, visit About Ads.
• To stop receiving specific kinds of emails, click "unsubscribe" in any such email or contact us at privacy@dromo.io. We'll still send important service emails.

You can ask to see, change, or delete your data. You can also ask us to limit how we use it. If you want to do any of these things, contact us at the details below. You can also complain to your local data protection authority.

Under the "Shine the Light" law, you can ask us once a year for a free report on what personal information we've shared with third parties for marketing. To request this, email us at privacy@dromo.io.

California Consumer Privacy Act ("CCPA") Privacy Notice

You're considered a California resident if:

1. You're in California for more than just a short visit, or
2. You live in California but are temporarily elsewhere.

If you fit either of these, you have specific rights regarding your personal information under California law.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

We may also collect other personal information outside of these categories in instances where you interact with us in-person, online, or by phone or mail in the context of:

• providing help through our customer support channels;
• participating in customer surveys; or
• facilitating the delivery of our Services and responding to your inquiries.

What information have we shared?

In the past year, we've shared information from Categories A, B, D, F, G, H, I, and K with third parties for business reasons. We haven't sold any personal information for a business or commercial purpose.

What are your rights?

Delete Your Data. You can ask us to delete your personal information. Some legal exceptions apply.

Know Your Data. You have the right to know what data we collect, how we use it, and who we share it with.

No Discrimination. We won't discriminate against you for exercising your privacy rights.

Verify Your Identity. We'll need to confirm your identity when you make a request about your data.

Other Rights. You can correct your data, limit how we use it, or appoint someone to make requests for you. You can also opt-out of future data sales.

To exercise any of these rights, email us at privacy@dromo.io.

Some browsers have a "Do-Not-Track" option, but there's no standard way to recognize it yet. So, we don't currently support or respond to these settings. If that changes, we'll update our privacy policy.

We may change this Privacy Policy occasionally. Any changes will take effect when the updated policy is posted online. If major changes occur, we'll either post a notice or directly notify you. We recommend checking this policy regularly to stay informed about how we protect your information.

Depending on your country's laws, you may be able to access, change, or delete your personal information. To do so, please contact us using the information provided below.

If you have questions or comments about this notice, you may email us at privacy@dromo.io, or by post to:

Dromo, Inc. Data Privacy Unit 548 Market St, Suite 87630 San Francisco, CA 94104

Dromo, Inc. has appointed Rickert Rechtsanwaltsgesellschaft mbH to be its representative in the EU. If you are a resident of the European Union, you may contact them directly regarding our processing of your information, by post to:

Rickert Rechtsanwaltsgesellschaft mbH, Dromo Inc., Colmantstraße 15, 53115 Bonn, Germany

Dromo, Inc. has appointed Rickert Services Ltd UK to be its representative in the UK. If you are a resident of the United Kingdom, you may contact them directly regarding our processing of your information, by post to:

Rickert Services Ltd UK, Dromo Inc., PO Box 1487, Peterborough, PE1 9XX, United Kingdom