EFFECTIVE: APRIL 3, 2024
Very Good Security, Inc. (“VGS”, “we”, “us”, “our”) complies with the EU-U.S. Data Privacy Framework Principles and the Swiss-U.S. Data Privacy Framework Principles as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union or Switzerland to the United States. VGS has certified to the Department of Commerce that we adhere to the Data Privacy Framework. If there is any conflict between the terms in this Data Privacy Framework Notice and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. To learn more about the Data Privacy Framework, and to view our certification, please visit https://www.dataprivacyframework.gov.
VGS may collect personal data from existing and prospective customers in the EU, EEA, and Switzerland. VGS may use this information to provide services to our customers, including processing service requests, negotiating contracts, processing payments, communicating with customers, providing promotional and marketing offers, providing customer support, detecting and preventing fraud, and complying with governmental, legislative, and regulatory requirements. VGS may be required to disclose an individual's personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.
When VGS Customers in the EU, EEA, or Switzerland use our services, VGS may process personal information on behalf of the EU controller. VGS does not determine the data collected, stored, and transmitted by its customers nor how the data is classified, accessed, exchanged, or otherwise processed. VGS customers are solely responsible for complying with applicable laws and regulations and ensuring the personal information they control and process meets these requirements.
VGS has written agreements in place with our customers that define the services provided and VGS’s obligations with respect to customer data. VGS provides services only at the direction of our customers in alignment with the written agreements.
VGS complies with the privacy principles as described below:
As described in VGS's Privacy Notice, VGS will provide timely and appropriate notice of the data we are collecting, how we will use it, and the types of third parties with whom we may share it. We will provide this notice by posting our Privacy Notice on our Website, or, if the changes are significant customers will be provided an updated notice via email.
VGS processes its Customer's client's data according to the terms of the written agreement between VGS and the Customer.
VGS offers customers the opportunity to choose to opt out of having personal data transferred to third parties for reasons not listed in our Privacy Notice or used for purposes beyond those for which the data were collected. VGS does not sell data.
VGS written agreements with Customers limits our ability to disclose personal information to third parties or to use personal information for purposes other than those specified in the contract. VGS will assist in putting individuals who directly contact us regarding exercise of choice in contact with the EU controller to provide a choice mechanism.
VGS shares data with third parties to facilitate various business processes. A full list of reasons VGS shares data can be found in the Privacy Notice in the section entitled “With Whom Does VGS Share Your Data?”. VGS only shares Personal Information required for the third party to perform its services, and they will not be authorized to use it for any other purpose, unless you have consented to such disclosure.
For the actions of third party agents VGS engages to process data on our behalf, VGS remains responsible and liable under the Data Privacy Framework Principles if a third party agent processes the personal data in a manner inconsistent with the Data Privacy Framework Principles, unless VGS proves that we are not responsible for the event giving rise to the damage.
As described in our Security Statement, VGS is committed to securing our customers' data. We include security terms in our third party contracts, and our hosting services have been assessed by third party auditors in accordance with both PCI-DSS and SOC2 Security Standards.
VGS Customers are responsible for implementing security measures appropriate to the nature and volume of data stored on or transferred to VGS's system.
VGS operates under contractual requirements governing data retention, accuracy and purposes of processing. When VGS does collect personal information, we will take reasonable measures to verify that the personal information we collect is relevant and reliable for its intended use, and that it is accurate, complete, and current. Contact privacy@verygoodsecurity.com.
VGS offers individuals from whom it directly collects information reasonable access to their Personal Information and will provide such individuals reasonable opportunity to correct, amend, or delete inaccurate information. Contact privacy@verygoodsecurity.com.
If contacted by one of our customers' clients, VGS will work with the EU controller to facilitate access through the Customer's access methods.
VGS periodically assesses its Privacy Notice and Data Privacy Framework Notice to ensure that it is accurate, comprehensive, and prominently displayed. VGS is committed to ensuring that complaints are resolved in a timely manner, and we will investigate and attempt to resolve any complaints and disputes regarding the collection, use, and disclosure of Personal Information in accordance with the Privacy Principles.
In compliance with the Data Privacy Framework Principles, VGS commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the Data Privacy Framework Principles. European Union and Swiss individuals with Data Privacy Framework inquiries or complaints should first contact VGS at:
Very Good Security, Inc.
General Counsel
207 Powell Street, Ste 200
San Francisco, CA 94102
Or by email: privacy@verygoodsecurity.com
If you have unresolved privacy or data use concerns, VGS commits to cooperate with the panel established by the EU data protection authorities (DPAs) and/or the Swiss Federal Data Protection and Information Commissioner and comply with the advice given by the panel and/or Commissioner with regard to data transferred from he EU and/or Switzerland.
If personal information about you is transferred by VGS from the EEA to the U.S. pursuant to EU-US Data Privacy Framework Principles, and you have an unresolved concern regarding personal information processing about you that we have not addressed to your satisfaction, please contact the EU authorities at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.
If personal information about you is transferred by VGS from Switzerland to the U.S. pursuant to Swiss-U.S. Privacy Shield Framework Principles, and you have an unresolved concern regarding personal information processing about you that we have not addressed to your satisfaction, please contact the Swiss FDPIC at https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html
Under certain conditions, described more fully on the Data Privacy Framework website, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.
The Federal Trade Commission has jurisdiction over VGS's compliance with the Data Privacy Framework Principles.