Effective on May 23, 2018
This policy applies to:
Data protection law in Europe contains a number of “lawful bases” – which are really legal justifications which mean organizations like us are allowed to have your personal information in the first place. For our EU users, we have been careful to ensure we have a lawful basis for all data we have. More Details.
We may collect personal data from customers both online and offline. Online, we may collect information through our Site, an affiliated site (such as a promotional microsite linked to our site), a Puppet page on a community website (such as Facebook, LinkedIn, Twitter, or the like) or through similar online avenues. In many cases, such information will be collected directly from you, such as through a transaction or inquiry (including via a telephone call) or your submission of a form, registration or communication to us. Information may also be gathered from our affiliates and from third-party sources including without limitation:
We may combine data collected from these disparate sources unless we tell you otherwise. More Details.
We may disclose personal data you provide to our affiliates and to consultants, service providers, contractors, and channel partners that we use to support our business and operations (e.g., delivery services, financial institutions, fulfillment services, technical support, advertising, public relations, media and marketing services, competitions and contest-related services, e-commerce and other web-related services such as web hosting and web monitoring services and event-related services such as online and offline data capture) who have agreed to keep the information confidential and use it only to provide the applicable service(s). In some cases, we work with other companies who help to gather information from you or help us to communicate with you. Where consultants, service providers and consultants process the personal data of EU or UK users outside the European Economic Area, and in particular in the United States our policy is to have an appropriate legal mechanism in place to ensure that transfer of personal data is in compliance with European data protection law, typically model clauses or standard contractual clauses.
Where the law allows it and with your agreement, we may share customers’ personal data with affiliates or selected third-party partners to enable them to market their or other selected third parties’ products and services to you.
We may also disclose personal data to third parties (including, without limitation, governmental agencies) if required to do so by law, regulation or court order; to respond to governmental and/or law enforcement requests; to identify, contact or bring legal action against someone who may be causing injury to or interfering with our (or others’) rights or property; to support any actual or threatened claim, defense or declaration in a case or before any jurisdictional and/or administrative authority, arbitration or mediation panel; or in connection with disciplinary actions/investigations. Likewise, we may disclose or transfer personal data to third parties in connection with the sale, assignment or other transfer of our business.
We may make full use of all information that is de-identified or otherwise not in personally identifiable form.
We retain personal information for as long as we have a lawful basis to keep it; this includes when we require it in order to meet our contractual obligations, to establish or defend our legal rights or resolve any legal proceedings. We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.
We take appropriate steps to protect personal data from loss, misuse and unauthorized access, disclosure, alteration or destruction, whether in transmission or storage. Please keep in mind, however, that there is no such thing as perfect security, and no Internet transmission is ever completely secure or error-free. Moreover, you are responsible for maintaining the confidentiality of any user name and password you use.
Puppet wants to keep in touch with you in ways that you find to be beneficial. If you don’t want Puppet to use your contact information to communicate with you for promotional purposes (such as to tell you about other products and services that might be of interest), please tell us that when you provide your contact information, or you can also let us know your preference later, by contacting us as specified in the “Contact Us” section below. Keep in mind that these preferences regarding promotional contacts do not mean that Puppet might not contact you for other reasons connected to the service you request or receive, such as those related to an order you placed, an inquiry you made, a newsletter to which you may have subscribed, a membership you undertook, an event for which you registered, a legally required notice and so on.
Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask us for a notice describing what categories of personal customer information Puppet shares with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. That notice will identify the categories of information shared and will include a list of the third parties and affiliates with which it was shared, along with their names and addresses. If you are a California resident and would like a copy of this notice, please submit a written request to the following address:
308 SW 2nd Ave
Portland, OR 97204
In your request, please specify that you want a “Your California Privacy Rights Notice “. Please allow 30 days for a response.
You have the right under certain circumstances:
You can also exercise the rights listed above at any time by contacting us at email@example.com.
If your request or concern is not satisfactorily resolved by us, you may approach your local data protection authority (see http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.html). The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data, as well as deal with any complaints that you have about our processing of your personal data.
308 SW 2nd Ave
Portland, OR 97204
Or at firstname.lastname@example.org.
Puppet, Inc. is the US-based parent company and is responsible for the operation and design of the Site and for setting global strategy of Puppet’s marketing activities and the selection and configuration of IT systems. Puppet, Inc. has subsidiaries in various countries including Puppet Labs Limited in the UK, Puppet Labs Australia Pty. Ltd. In Australia, Puppet Labs s.r.o. in the Czech Republic, Puppet Pte. Ltd. in Singapore, Puppet Labs S.R.L. in Romania, and Puppet Kabushiki Kaisha in Japan.
Data protection law in Europe contains a number of “lawful bases” – which are really legal justifications which mean organizations like us are allowed to have your personal information in the first place. For our EU users, we have been careful to ensure we have a lawful basis for all data we have. Our lawful bases include:
In certain circumstances, we need your personal data to comply with our contractual obligation to deliver Puppet software products and services. For example, if you want to use Puppet software products and order or download them through our Site, we need your name and contact details so we can communicate with you and provide the software.
Sometimes the law says we need to collect and use your data. For example, we can pass on details of people involved in fraud or other criminal activity to law enforcement and tax laws require us to retain records of orders and payments for Puppet software and related services, which can include contact details at our corporate clients.
This is a technical term in data protection law which really means we have a good and fair reason to use your data and we do so in ways which does not hurt your interests and rights.
We sometimes require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.
For example, we will send your promotional communications about our service, subject to your legal rights to control whether we do so.
We do analyze how users interact with our Site and the Puppet software so we can understand better what elements of the design are working well and which are not working so well. This allows to improve and develop the quality of the online experience we offer all our users.
We collect personal data about our customers in a number of ways. In this section, we describe what types of personal data we collect, the ways we collect it and how we use it. While we have tried to be complete, this list is not necessarily exhaustive, given that these activities can vary from time to time. When we collect information, we will tell you at the point of collection what information is required and what information is optional.
The types of personal data collected by us include the following, depending on how you access or use our services:
We use the information to provide and promote our products and services to you, allow you to attend events and webinars and enter contests and promotions, maintain our business records and other purposes set out in our policy. Providing the information is not mandatory, but we do need to collect in order to do these things. We say in our online forms if any of the information we ask for is not required.
We, or our third party providers, also collect and use information automatically generated as users interact with the Site or our software products, which includes the browser and operating systems types and versions used, installer commands, web interface clicks, mouse gestures, data relating to the submission of online forms (but not the content of the forms), IP addresses, and page views, URLs visited within our software products, error messages and related data about software errors (“Telemetry Data”). Puppet may use and share the Telemetry Data with third parties, like our cloud-based support management system to help Puppet improve the user experience and the Site.
The Telemetry Data collected and used by Puppet is de-identified so that it does not reveal the name, role, contact details or other real world identifiers of users and Puppet does not collect or use any information from content that users process within or uploads to our software platform. If Puppet is collecting Telemetry Data from the Site, the Customer may opt-out of this functionality at any time.
The Site may also use IP addresses for the same purposes identified above, as well as to analyze trends, administer the site, track users’ movements and gather broad demographic information for aggregate use.
We also engage one or more third party service providers to serve online advertisements on our behalf. They may use a “pixel tag” which triggers a cookie to collect information about your visits to the Site and to other websites, and they may use that information and share and combine it with other information with their partners to show you advertisements for goods and services you might be interested in on the Website and on other websites and apps and social media platforms like Facebook and LinkedIn including by observing the kinds of products and subject-matter you are interested in and certain demographic information about you.
We may use web beacons (also known as Internet tags or clear GIFs) on our websites to access and set cookies and otherwise help us to better understand how users are moving through our websites. Information provided by the web beacon includes the computer’s IP address, the type of browser being used and the time that the web beacon was viewed. We may also use web beacons in emails and newsletters so that we know when such communications have been opened and to otherwise help us tailor our communications to individual users.
We use personal data about customers in contexts that include the following: