NINJAONE PRIVACY NOTICE
FOR DATA SUBJECTS

1. Purpose of data processing

 This Privacy Notice for Data Subjects (this “Privacy Notice”) describes how NinjaOne, LLC and its affiliates (collectively, “NinjaOne”, “we,” or “us”) process your personal data.

Main purposes of data processing are:

• Business communication and conducting business operations,
• Fulfilment of a contract,
• Marketing communication (newsletters, advertising emails),
• Content downloads,
• Events in presence organized by NinjaOne alone, or in cooperation with other partners,
• Online events organized by NinjaOne alone, or in cooperation with other partners (i.e. Webinars).

In some cases, we may record telephone or video calls solely for the purpose of quality assurance. You will be informed beforehand, and you will have a choice to either accept or reject the recording.

2. Data Controller

Data Controller, directly responsible for processing of your personal data is:

NinjaOne, LLC, a Delaware Limited Liability Company
Suite 200, 3687 Tampa Road, Oldsmar
Florida 34677, USA
in cooperation with the EU-Subsidiary in Germany:
NinjaOne GmbH
Alexanderstraße 1
10178 Berlin, Germany
Email: [email protected].

3. Data Protection Officer

Our Data Protection Officer can be contacted at: [email protected].

4. Categories of personal data

• Full name,
• Company name,
• Title,
• Role,
• Telephone number,
• Address,
• Email,
• Country.

We will collect the personal data that we process mostly directly from you. In some circumstances, we may receive your personal data from third parties, such as our business Partners.

We may also collect and process the following special categories of personal data:

• Physical disability,
• Race or ethnic origin, religious affiliation.

5. Legal basis for data processing 

The processing of your personal data is permissible based on legal basis.
This may be:

• Your consent,
• Our legitimate interest,
• Performance of a contract or to take steps at your request prior to your entering into a contract,
• Our legal obligation,
• Public interest.

6. Cross-Border Data Transfers and Processing Outside of the EEA

Your data will be processed outside of the EEA. We ensure however, that those data transfers are carried out in accordance with applicable privacy laws. This means that any party outside of the EEA, which process your personal data, is contractually obligated to provide the level of data protection equal to the level of data protection required by the GDPR.

7. Data Sharing

Your personal data is primarily processed within the NinjaOne Group in the EEA and the USA and can be shared with our Affiliates with whom we have appropriate contractual arrangements in place.

Our Affiliates do not use your personal data for their own purposes and are only permitted to process it for specified purposes in accordance with our instructions. Acting upon your consent, we may in some cases share your data with third parties, i.e. business partners.

8. Data Security

We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we limit access to personal data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access.

9. Data Retention and Deletion

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal data for as long as we have your valid and unrevoked consent.

Applicable retention periods:

• Business communication: as long as legally applicable retention periods apply,
• Marketing communication (newsletters, advertising emails): consent withdrawal or (if you are our Customer) objection to data processing,
• Content downloads: contract termination,
• Events in presence organized by NinjaOne alone or in cooperation with other partners: 30 days or upon consent withdrawal,
• Online events organized by NinjaOne alone or in cooperation with other partners (i.e. Webinars): 30 days or upon consent withdrawal,
• Recordings of video and telephone calls: 30 days or upon consent withdrawal.

You are not obliged to share any of your personal data with us, however in such cases, we may not be able to provide you with the services you requested.

10. Tracking and automated decision making

With regard to marketing communication, we can see whether you have opened our email and clicked on a link therein. Your personal data will not be used in automated decision-making process.

11. Rights of Access, Correction, Erasure, and Consent Withdrawal

With reference to the processing of your personal data you have the right to:

• Access your data,
• Rectify your personal data,
• Erase your data or restrict data processing,
• Withdraw your consent if that was the legal basis for data processing. This will not impact the lawfulness of processing preceding the withdrawal of the consent.

Any such communication must be in writing, therefore, to exercise your rights, please contact us at: [email protected]. Please note that in course of your request we may ask for specific information from you to help us confirm your identity.

You also have a right to lodge a complaint with you local supervising authority.

12. Right to Object

You have the right to object to processing of your personal data if it is based on our legitimate interest. This right must be exercised in writing at: [email protected].

13. Changes to This Privacy Notice

We reserve the right to update this Privacy Notice at any time. If we would like to use your previously collected personal data for different purposes than those, we notified you about at the time of collection, we will provide you with notice and, where required by law, seek your consent, before using your personal data for a new or unrelated purpose. We may process your personal data without your knowledge or consent where required by applicable law or regulation.

Status of this information: April 2024