NinjaOne Privacy Policy

14. Additional Detail for California Residents

This Section 13 applies only to “personal information” about California residents, as that term is defined in the California Consumer Privacy Act (“CCPA”), and it supplements (and, in some cases, repeats) the information in the rest of our Privacy Policy above. Data about individuals who are not residents of California is handled differently and is not subject to the same rights described in this Section. This Section does not apply to data that NinjaOne handles in its capacity as a processor for its customers, even when such data is about a resident of California, or to other data or activities that are not subject to the relevant provisions of the CCPA.

A. Collection, Retention, and Use of California Personal Information

During the 12 months leading up to the effective date of this Privacy Policy, NinjaOne collected the categories of personal information described below. We intend to retain this information for as long as we feel it is necessary for the purposes described further below, or for any longer period required by law.  Because we may collect and use the same category of personal information for different purposes and in different contexts, there is no general fixed retention period that always will apply to a particular category of personal information.  Examples of how long we normally intend to retain personal information in certain situations are set forth below.

Category of personal information	Examples of how long we normally plan to keep this information
Identifiers (such as name, username, physical address, email address, and other contact information)	We may retain identifiers associated with points of contact within existing customers for the duration of the customer’s contract with NinjaOne, and for 2 years after that for related administration and sales purposes. We may retain identifiers associated with non-customer persons until 1 year after they unsubscribe from emails, or 1 year after the person’s last interaction with NinjaOne (whichever is greater) for analytics purposes.
Commercial information (such as information provided to us in your communications, transaction data, and information about interactions with NinjaOne or our partners);	We may retain information on a person’s interest in our products for up to 1 year after the person’s last interaction with NinjaOne, or 2 years after the end of their organization’s contract with NinjaOne.
Financial data (such as payment information)	We may retain financial data for 7 years in support of financial statements/filings and key financial or business process controls.
Internet or other network or device activity (such as IP addresses, device identifiers, cookie data, device attributes, device usage information, browsing information, metadata, and other information)	We retain the internet and other network device activity information of our existing customers for the duration of the customer’s contract with NinjaOne, and for 2 years after that for account authentication, fraud detection, and other cybersecurity purposes.
Professional or employment-related data (such as company name)	We typically retain professional or employment data of our customers’ and prospective customers’ personnel for 1 year after the person’s last interaction with NinjaOne, or 2 years after the end of a customer’s contract with NinjaOne.
Inferences drawn from any of the above	We often retain inferences for the same period of time for which we retain the underlying data.

NinjaOne uses personal information for the following purposes:

• Administer your account, including to process your registration and verify your information;
• Provide, manage, and improve our services;
• Conduct business operations in support of our services, such as auditing, security, fraud prevention, invoicing and accounting, sales and marketing, analytics, and research and development;
• Send messages that are related to services we provide (g., welcome messages, confirmation notices, and the like), your activity on the Website, or updates and changes to the Website or services, consistent with any applicable communications options we offer;
• Contact you regarding NinjaOne and third-party products, services, surveys, research studies, promotions, special events, and other subjects that we think may be of interest to you, consistent with any applicable communications options we offer;
• Send you other marketing and promotional communications, consistent with any applicable communications options we offer;
• Customize content, preferences, and advertising on the services, across the Internet and elsewhere;
• Create aggregated, de-identified, or anonymized information;
• Comply with laws, regulations, and other legal process and procedures; and
• Establish, exercise, or defend our legal rights.

“Sale,” “Sharing,” and Related Opt-out As described further below, some of our disclosures of personal information qualify under the CCPA as what it defines as a “sale” or “sharing” of personal information.  During the 12 months leading up to the effective date of this Privacy Policy, we “sold” and “shared” (as those terms are defined under the CCPA), what the CCPA calls “identifiers” (like IP addresses and email addresses), “internet or other electronic network activity information” (like information regarding an individual’s browsing interactions on a website), and “commercial information” (like the fact that a browser visited a page directed to people who are considering purchasing from us) to third parties that assist us, such as marketing providers and analytics providers.  This practice continues today.  To our knowledge, we do not “sell” or “share” (as those terms are defined under the CCPA) the personal information of individuals under 16 years of age. You can exercise your right to opt out of those disclosures by following the instructions on our “Your Privacy Choices” form. Your browser may also offer a way to activate the Global Privacy Control signal (“GPC”).  The Website treats qualifying browsers for which the user has activated the GPC signal as having opted out of what CCPA calls a “sale” or “sharing” of any California personal information that is collected on that site from that browser using cookies and similar technology.  You can override that treatment for a GPC-enabled browser by using the cookie controls available via the Cookie Preferences link in the Website’s footer to opt into particular categories of cookies from that browser.  In that case, “sales” and “sharing” via cookies and similar technology in those categories may resume on that browser. Opting out of “sales” and “sharing” limits only some types of disclosures of personal information, and there are exceptions to all of the rights described in this Section. Other Disclosures of Personal Information The following chart indicates the categories of personal information that we collected from Californians and the categories of third parties to whom we disclosed this data during the 12 months leading up to the effective date of this Privacy Policy.

Category of personal information	Categories of entities to whom we disclosed it
Identifiers (such as name, username, physical address, email address, and other contact information)	·  Our affiliates. ·  Our customers. ·  Third parties that assist us, such as our providers of technical services (e.g., providers of data storage, web hosting, security), marketing providers, analytics providers, payment processors, and other subcontractors. ·  Joint marketing partners, including organizations with whom NinjaOne partners to hold events and contests. ·  Entities involved in dispute resolution (such as an arbitrator or an opposing party). ·  Entities involved in potential or actual significant corporate transactions or events involving NinjaOne or its affiliates. ·  Governmental entities.
Commercial information (such information provided to us in your communications, transaction data, information about interactions with NinjaOne or our partners);	Same as first row in this chart.
Financial data (such as payment information)	Affiliates and third parties that assist us, such as payment processors.
Internet or other network or device activity (such as IP addresses, device identifiers, cookie data, device attributes, device usage information, browsing information, metadata, and other information)	·  Our affiliates. ·  Third parties that assist us, such as our providers of technical services (e.g., providers of data storage, web hosting, security), marketing providers, analytics providers, payment processors, and other subcontractors.
Professional or employment-related data (such as company name)	·  Our affiliates. ·  Third parties that assist us, such as our providers of technical services (e.g., providers of data storage, web hosting, security), marketing providers, analytics providers, payment processors, and other subcontractors.
Other information that identifies or can be reasonably associated with an individual	·  Our affiliates. ·  Third parties that assist us, such as our providers of technical services (e.g., providers of data storage, web hosting, security), marketing providers, analytics providers, payment processors, and other subcontractors.
Inferences drawn from any of the above	·  Our affiliates. ·  Third parties that assist us, such as our providers of technical services (e.g., providers of data storage, web hosting, security), marketing providers, analytics providers, payment processors, and other subcontractors.

We do not use or disclose “sensitive personal information” covered by this Privacy Policy and as defined in the CCPA in a manner that requires us to offer a special right to limit our use of this data under the CCPA due to its sensitive nature.

b. CCPA Right to Access, Correct, or Delete Personal Information

If you are a California resident, California law also may permit you to request that we:

• Provide access to and/or a copy of certain information we have about you;
• Delete certain information we have about you;
• Correct certain personal information we have about you; or
• Provide you the categories of personal information we have collected or disclosed about you in the last 12 months; the categories of sources of such information; the business or commercial purpose for collecting or selling your personal information; the categories of third parties with whom we shared personal information; and more specific detail about what categories of information were “sold,” “shared,” or disclosed to particular categories of third parties, similar to the detail above this Section of the Privacy Policy.

Certain information is exempt from such requests under California law. For example, we need certain information to provide our services to you, so we may reject a deletion request for that information while providing services to you. To request to exercise any of these rights and receive the fastest response, please email us as described at the end of this Privacy Policy. We will take steps to verify your identity to our satisfaction before responding to your request, which may include, depending on the type of request you are making, the sensitivity of any data you are requesting, and the nature of your relationship with us: verifying your name, asking you to click on a link that we send to your email address, requesting that you login to an account you maintain with us, or requesting that you provide us with information about our relationship that only you are likely to have.

c. Requests Made by Agents

For security and legal reasons, we do not accept personal information requests that require us to use a third-party service (such as one operated by an agent) to view or respond to the requests. If you are an agent making a request on behalf of a consumer, we reserve the right to take steps to verify that you are authorized to make that request, which may include requiring you to provide us with written proof such as a notarized authentication letter or a power of attorney. We also may require the consumer to verify their identity directly with us. Because opt-out requests for sales made through cookies and related technology must be performed from each browser that is used to access our Services, it is easiest for the consumer to perform such opt-outs themselves. However, if a consumer wishes for an agent to perform browser-based requests on their behalf, the consumer may arrange for the agent to use the consumer’s browser to make such requests. We are not responsible for the security risks of this or any other arrangements that a consumer may have with an agent. For clarity, this is not permission for any user to share their login credentials with an agent or any third party. Such sharing is prohibited and is not required for an agent to make requests under this Privacy Policy.

d. Nondiscrimination

You also have a right not to receive “discriminatory treatment” (within the meaning of the CCPA) for the exercise of the privacy rights conferred by the CCPA.