Smartsheet Offerings Privacy Notice
This Offerings Privacy Notice (“Offerings Notice”) covers how Smartsheet processes information about you when you use or interact with our applications and services (the “Offerings”).
Integrations; Notifications; Forms; Linked Websites
Choices Relating to Your Use of the Services
Scope
Our Offerings permit users to share and manage information by uploading and submitting data, images, files, or other content that can be shared, stored, and accessed through the Offerings ("Customer Content"). This Offerings Notice covers user account information and usage data when a user is interacting with the Offerings. This Offerings Notice does not cover Customer Content, including any personal data contained within such content, nor does it cover the use of any third party integrations with the Offerings (as discussed further below). For information relating to how we process Customer Content, please review our Data Processing Addendum.
Personal Data We Collect
We collect certain personal data such as account data, user profile data, and usage data in order to provide the Offerings. See this table for additional categories of personal data that we collect.
How We Use Personal Data
We use your personal data when we have a lawful basis to do so, and as illustrated by this table. For example, we use your personal data to provide the Offerings, for customer support, for personalization, for marketing, for analytics and improvement, and at your instruction.
How We Share Personal Data
We will not sell your personal data to a third party or allow a third party to use personal data we provide for its own marketing purposes. We share information about you with your consent, at your request (including when you use 'Integrations or Notifications'), or as follows:
At Your Direction. If you choose to use certain products and features, such as sending electronic communications from the Offerings, including but not limited to email notifications, update requests, confirmations, at-mentions or other in-application features. By using these electronic communications, your personal data (e.g., your name, your email address, and possible other personal data contained within the Customer Content being sent) will be shared with your intended third party recipients.
To Other Users of the Offerings. Some of the features and functionality of the Offerings involve disclosure of your personal data to other users of the Offerings. For example, your name, email address, and profile image are displayed when a user views the sharing information on a container, such as a sheet, report, or dashboard; views the history details on a container (e.g., your email, access/edits, date and time stamp, etc.); or accesses your in-application profile. Organizations and other users, as Controller, control the disclosure of content with other users of the Offerings. When acting as Processor, we follow instructions from customers, including their users, with respect to how data is shared with other users of the Offerings.
To Organizational Users. When you use the Offerings on behalf of an organization (e.g., your employer) or in connection with your organization's domain (e.g., you are registered using your employer's domain), your use is subject to our Acceptable Use Policy and your organization’s policies regarding the use and protection of personal data. With respect to personal data contained in Customer Content, we are processing Customer Content as a Processor on behalf of your organization, who is the Controller. As such, your organization’s system administrator has the ability to access any Customer Content, including any personal data contained therein. Smartsheet is not responsible for the privacy or security practices of our customers. We also share personal data with your organization about your use of the Offerings that includes technical details (e.g., metadata) relating to your content or usage of the Offerings. If you have questions about how your data is being accessed or used by your organization, please refer to your organization's privacy policy and direct your inquiries to your organization’s system administrator. Please note that if you lose access to your account (e.g, change of employment), you may lose access to content associated with that account.
To an Organization. If you use Smartsheet on behalf of an organization (e.g., your employer) or in connection with an organization's domain, that organization can: (i) access information associated with your use of the Offerings including usage and other data (e.g., who has accessed, shared, amended, created, edited, or deleted Customer Content) and the contents of the communications and files associated with your account; (ii) control and administer your account, including controlling privacy-related settings (e.g., in-app profile settings including choices relating to displaying a profile image); and, (iii) access and control content (as noted above, Customer Content is outside the scope of this Offerings Notice). If you have questions about how your data is being accessed or used by an organization, please refer to the organization's privacy policy and direct your inquiries to the organization’s system administrator. Please note that if you lose access to your account (e.g., change of employment), you may lose access to any content or data associated with that account.
To Resellers. If you sign up for certain products or services (e.g., free trials), we will share your personal data with a Smartsheet reseller so they can contact you about our Offerings. We will disclose sharing of your personal data with resellers, and will, where required by law, obtain your consent or allow you to opt out from such sharing. If you purchase Offerings through a reseller (regardless of location), we will share certain information about your account and usage with the reseller (or their affiliate) in furtherance of their relationship with you. Resellers are independent data controllers of your personal data, a full list of resellers is available here.
To Payment Processors. We use third parties (identified as Business Operations Subprocessors on our Subprocessors page) to assist in processing payments from customers. Smartsheet has data processing agreements with such payment processors that limit their use of and access to personal data. If you use an additional third party to facilitate your payment obligations, we will share certain usage and billing-related information about your account with such third parties for billing and business administration purposes. Payment processors are independent data controllers of your personal data, please see their respective privacy notices for more information about their privacy practices.
To Our Service Providers. We use third party service providers to process your personal data to assist us in business and technical operations. Smartsheet has data processing agreements with such service providers limiting their use of and access to personal data to specific purposes. They provide services relating to, for example, customer relationship management, communication, fraud detection and prevention, billing, customer support, internet and connectivity, marketing, security, training, and user experience.
To Infrastructure Processors. We use third parties for the infrastructure used to host personal data we process, including cloud providers. Smartsheet has data processing agreements with such service providers limiting their use of and access to personal data to specific purposes.
To Affiliates. If you purchase one of our affiliates’ services through Smartsheet, we will share your personal data with the affiliate to provision and service your account.
In Transactions Involving Third Parties. We will make services, software, and content provided by third parties available for use on or through the Offerings; if you engage with a third party provider of such features, you will be notified or otherwise made aware of personal data being shared related to those transactions with that third party.
As Required by Law. We may disclose your personal data if we believe we must do so to comply with the law or a subpoena, bankruptcy proceeding, or similar legal process.
To Protect Rights. We will disclose your personal data, such as your name, contact information, and billing information, to enforce our agreements with you or to protect the rights and safety of Smartsheet, our customers, our users, and the general public, or as evidence in litigation in which we are involved.
As Aggregate and Anonymized Information. We will share aggregate or anonymized information about you with our third party service providers for our internal business purposes, which will include marketing, advertising, research, or similar purposes (e.g., we may provide information for our earnings reports, such as the number of active users).
In a Business Transaction. If Smartsheet is involved in a dissolution, reorganization, financing, public offering of securities, merger, acquisition, or sale of all or a portion of its assets, your information will be transferred to providers, advisors, accountants, attorneys, the acquiring entity, or other third parties as part of the transaction (provided that we inform such individuals that they must use your personal data only for the purposes disclosed in this notice), and will also be reviewed as part of the due diligence review for the transaction (e.g., we need to provide a list of all customer accounts and payment histories).
Integrations; Notifications; Forms; Linked Websites
Connectors and Integrations. Our Offerings will provide access via connectors and integrations (“integrations”) to your third party accounts such as Microsoft, Tableau, Slack, or Facebook. Integrations can be used to pull and/or push information from or to the Offerings, and to enable the applicable third party to receive notifications, such as sheet updates, from the Offerings. Any information you authorize to be transferred from the Offerings to an integration is governed by the third party’s privacy statement, not this one. We encourage you to carefully read the privacy statement of any third party you authorize to receive information from the Offerings.
Sending Notifications. Our Offerings allow you to send notifications (e.g., update requests) to other individuals through email, SMS, and other third party messaging platforms (e.g., Slack, Facebook Messenger, and Microsoft Teams). You may update your preferences with respect to notification delivery through the Offerings’ personal settings. Any information you authorize to be transferred from the Offerings is governed by the third party’s privacy statement, not this one. We encourage you to carefully read the privacy statement of any third party you authorize to receive information from the Offerings.
Forms. Our Offerings include a feature that allows users to publish online forms which allow individuals to submit data to the Offerings. While the data contained and provided by an individual is considered Customer Content and therefore not subject to this Offerings Notice, Smartsheet collects usage data (e.g., IP address, submission date and time, browser type, etc.) that could be considered personal data. For more information on what usage data is and how we use and collect it, please visit our Privacy FAQs.
Links to Other Websites and Third Party Content. Our Offerings include features which allow you to link to other websites and embed (e.g., iframes) content from third party sources with privacy practices that may differ from ours. Any information you submit to a website not belonging to Smartsheet or any of its affiliates is governed by that site’s privacy statement, not this one.
Mobile Application; Geolocation Data
If you choose to download certain Offerings, for example, the Smartsheet mobile application (“mobile app”), we will receive additional personal data from your mobile device, in accordance with your preferences. The mobile app may have access to your device’s camera or its geographic location depending on the features you enable in the Offerings (e.g., mobile barcode scanning). Through your device settings, you have the ability to configure what functionality (e.g., your device’s camera or mobile location) the mobile app can access and we will only access this information with your authorization. The mobile app will also gather information related to your use of the mobile app (e.g., device identification, login credentials, language, and time zone); device event information (e.g., crashes, system activity, and hardware settings); and information regarding your interaction with the mobile app, which we use to provide and improve the mobile app. If you use the Offerings on behalf of an organization, information obtained by the mobile app will be accessible to your organization. For additional information about your use of the mobile app, see the Mobile End User License Agreement.
Choices Related to Your Use of the Offerings
In addition to “Your Rights” described here, you have the following choices in relation to your use of the Offerings:
Closing Your Account. If you wish to close your account, you may do so following these instructions or by contacting Support. If you used the Offerings on behalf of your organization or in connection with your organization’s domain, any information you shared into the Offerings will continue to be accessible to your organization’s system administrator. If you share any content or information through our Offerings with other users, it will continue to be accessible to those users.
Correcting Your Account. If you are not using the Offerings on behalf of your organization, you may log in and use the Account Administration settings or submit this form to access or update your account profile information. If you are an organizational user, you may login and use the Account Administration settings or contact an administrator on your account to access or update account profile information. If you have questions about how to withdraw a consent you had provided, please complete this form.