Privacy Policy
Welcome to https://vercel.com and/or https://nextjs.org (each a "Site"), hosted by Vercel
Inc. ("Vercel", "we", "us" and/or "our"). Vercel provides a cloud platform for on-demand
deployment, related hosting and sharing services and analytics tools ("Services"). In
order to provide our Site and Services (collectively, "Platform"), we collect personal datafrom our customers ("Customers"). We also collect and/or host the personal data of ourCustomer's end users ("End Users") when our Customers' websites are hosted by
Vercel or our Customers use our Services. Throughout this Privacy Policy, "personal
information" or "personal data" refers to any information that is unique to an individual,such as name, address, email address, phone number, IP address and otherinformation that can reasonably identify an individual.
This Privacy Policy, along with our Cookie Policy, covers how we collect, handle anddisclose personal data on our Platform, including any affiliated websites, software orplatforms owned or operated by Vercel on which this Privacy Policy appears. Even
though we store End Users' personal data, it does not cover how or why our Customers
may collect, handle and disclose their End Users' personal data when they visit or use
their websites or platforms.
If you are located in the European Economic Area ("EEA") or the United Kingdom("UK"), this entire Privacy Policy applies to you. However, please see the Section titled"Additional Information for Users in the EEA and the UK.", which will provide more detail
information about which rights you have regarding the processing of your personal data.
We recommend that you read this Privacy Policy and our Cookie Policy carefully as bothprovide important information about your personal information and your rights under thelaw.
If you have any questions, comments, or concerns regarding this Privacy Policy, our
Cookie Policy and/or our data practices, or would like to exercise your rights, do nothesitate to contact us at privacy@vercel.com or see our information below.

Who We Are and How To Contact Us
Vercel is a Delaware corporation with the following contact information:
Vercel Inc.

440 N Barranca Ave #4133
Covina, CA 91723
privacy@vercel.com
For users in the EEA and the UK, note that we may collect your personal data as a 'data
controller' when we determine the means and purpose of processing, such as when we
process the personal data of our Site Visitors, Event Attendees and/or Customers, or as
a 'data processor' when we collect and process personal data on behalf of ourCustomers who use our Services and host their own websites with Vercel or Customers
that use our analytics tools. Similarly, for users in California, we currently act as a‘service provider’ to those ‘businesses’ that are subject to the California Consumer
Privacy Act when we collect and process personal data or information on behalf of ourCustomers who use our Services and host their own websites with Vercel or Customers
that use our analytics tools. This is further explained below.

To Whom Does This Policy Apply
Note at the outset that this Privacy Policy does not cover our Customers' websites. Each
Customer is responsible for posting its own terms, conditions, and privacy policies, andensuring compliance with all applicable laws and regulations.This Privacy Policy applies
to:Customers: as noted above, this includes any individual who registers individually or on
behalf of an entity or organization in order to use the Services.
Site Visitors: visitors to our Site, including those who may also opt in to receive
commercial communications from Vercel. This does not include any visitors to ourCustomers' individual
websites.
Event Attendees: Vercel hosts and/or sponsors annual conferences and is an active
participant at many other conferences, summits, and additional events (collectively,"Events"), and collects personal information from individuals when they attend (orregister to attend) Events.
End Users: Vercel may process End User data on behalf of its Customers. While ourCustomers are responsible, as data controllers or businesses, for how and why theycollect and process their End User personal data, this Privacy Policy also applies to any
End User personal information that we process, as a data processor or service provider,in order to provide Services to our Customers.

Children's Privacy
Vercel does not knowingly collect information from children under the age of 16. If you
are under the age of 16, please do not submit any personal data through the Platform.
We encourage parents and legal guardians to monitor their children's Internet usage
and to help enforce our Privacy Policy by instructing their children never to provide
personal data on our Platform without their permission.
If you have reason to believe that a child under the age of 16 has provided personal
data to Vercel through the Platform, please contact privacy@vercel.com and we will
endeavor to delete that information from our databases.

Changes To This Privacy Policy
This Privacy Policy was last updated on the date indicated below, but we suggest thatyou review it from time to time, as our Platform and our business may change. As aresult, at times it may be necessary for Vercel to make changes to this Privacy Policy(and/or our Cookie Policy). Vercel reserves the right to update or modify this Privacy
Policy and/or our Cookie Policy at any time and from time to time without prior notice.
However, if we make changes that we believe will materially impact this Privacy Policy,
the Cookie Policy or your rights, we will promptly notify you of those changes. Your
continued use of the Platform after any changes or revisions to this Privacy Policy shallindicate your agreement with the terms of such revised Privacy Policy.

What Information Do We Collect
What personal information we collect and process depends on how and why you use
our Platform. Generally, we process personal information that we receive:
Directly from you when you provide it to us, such as in connection with our Services orEvent registrations.
Indirectly, through automated technologies such as cookies, or from third parties.
On behalf of our Customers, when we process the personal data of their End Users
as part of our Services.
This is all explained in more detail below.

Information We Collect Directly From You
You can generally visit our Site without having to submit any personal information. If you
request more information, or sign up for our Services, we will collect personal
information as follows.
Account Information. When you register for a Vercel customer account (including
when you join for free) we request your email address and, on occasion, your telephone
number. Once your email and telephone number have been confirmed by our systems
and you have successfully signed up, we will ask you to create a username andoptionally upload a profile picture. We also provide you the option of submitting yourname, company name and location. This information is your "Account Information" forthe purposes of this Privacy Policy. Account Information is required to identify you as a
Customer and permit you to access your account(s). By voluntarily providing us withsuch Account Information, you represent that you are the owner of such personal dataor otherwise have the requisite consent to provide it to us.
Customer Payment Information. You are not required to enter your credit card
information unless and until you decide to continue with a paid subscription to ourServices. When you sign up for one of our paid Services, you must provide billinginformation. The information you will need to submit depends on which billing method
you choose. In order to process your payment Information, we use PCI-compliant
third-party processors, as explained in the Section on "Payment Processing" below. This
information is processed by our payment service provider and we receive a confirmationof payment, which we then associate with your Account Information and any relevanttransactions.
Event Attendee Information. We may collect personal information such as name,address, phone number and email address when participants register for or attend asponsored Event or other events at which Vercel (and/or its affiliates or representatives)
may be present. What information is collected depends on the Event, but any personal
information that Vercel receives in connection with an Event is processed in accordancewith this Privacy Policy.
Optional Information. We may also ask you to submit personal information if you
choose to use interactive features of the Platform, including participation in surveys,
promotions, requesting customer support, or otherwise communicating with us.

Information We Collect Indirectly

Device and Usage Information
When you download, use or interact with the Site, even if you do not have an account,
we, or authorized third parties engaged by us, may automatically collect information
about your use of the Site via your device, some of which is considered personal
information. "Device and Usage Information" that we collect consists of:Information About your Device: information about the devices and software you use
to access the Site — primarily the internet browser or mobile device that you use, thewebsite or source that linked or referred you to the Site, your IP address or device ID (orother persistent identifier that uniquely identifies your computer or mobile device on theInternet), the operating system of your computer or mobile device, device screen size,and other similar technical information.
Usage Information: information about your interactions with the Platform, including
access dates and times, hardware and software information, device event information,log data, crash data, cookie data. This information allows us to understand the screensthat you view, how you've used the Platform (which may include administrative andsupport communications with us), and other actions on the Platforms. We, or authorizedthird parties, automatically collect log data when you access and use the Platform, even
if you have not created an account or logged in. We use this information to administerand improve the Services, analyze trends, track users' use of the Platform, and gather
broad demographic information for aggregate use.
Note that Device and Usage Information is collected from our community boards, as well
as from our Customers' End Users who visit our Customers' websites hosted by Vercelor that use our Services.
Based on Device and Usage Information, we are also able to determine general location
information ("Location Information").
Location Information: we use a third-party database to map the general location towhich each IP address corresponds ("Location Information"). The Location Informationthat is mapped from an IP address is limited to country and city – we do not identify
precise location. We use Location Information in order to more effectively provide our
Services to our Customers. In addition, as part of our Services, we also share Location
Information (based on End Users’ IP addresses) to our Customers, so that they may
also more effectively provide their products and services to their End Users.

Cookies and Similar Technologies

Vercel uses cookies and similar technologies. Through our use of cookies (and similar
technologies), we or authorized third parties collect some Device and Usage
Information. Some cookies are necessary to make the Site and our content available toyou, while others are meant to improve the Site and enable us to analyze and measureaudience and traffic. For more information on our use of cookies and the data that theycollect, see our Cookie Policy.

Information from Third Parties
In some instances, we process personal information from third parties, which consists ofdata from our partners, such as transactional data from providers of payment services,or information from third parties with whom we host or sponsor Events. In all suchcases, individuals are informed of our processing activities and/or able to choose certain
preferences at the time of collection. From time to time, we may combine information wecollect as described above with personal information we obtain from third parties. For
example, we may combine information entered through a Vercel sales submission withinformation we receive from a third-party sales intelligence platform to enhance ourability to market our Services to Customers or potential Customers.

Information We Process on Behalf of Our Customers
As noted above, we deploy and host websites and provide other analytics tools for ourCustomers. These Customers may collect personal information from their End Users inconnection with the products or services that they offer to End Users. Because we host
our Customers' websites and provide other analytics tools, we process End Users'
information when they use our Customers' websites, web applications, and APIs. This
information may also include, but is not limited to, IP addresses, system configuration
information, and other information about traffic to and from Customers' websites(collectively, the "Log Data"), as well as Location Information derived from IP addresses.
We do not, however, collect or process End Users’ IP addresses through the use of ouranalytics Services. All of this information is stored on our Platform as part of ourServices, but Customers are responsible for the content transmitted across our network(e.g., images, written content, graphics, etc.), as well as any personal information theycollect. Customers are also solely responsible for notifying their End Users of theirpersonal information collection, use, and disclosure. With respect to Log Data, wecollect and use Log Data to operate, maintain, and improve our Services in performanceof our obligations under our Customer agreements. For example, Log Data can help us
to detect new threats, identify malicious third parties, and provide more robust security
protection for our Customers. It also helps us with improving our Platform, as explained
below.

Analytics
With the Device and Usage Information collected by our third-party analytics services,such as Google Analytics, as well as Log Data, we generate and process aggregatedinformation, such as statistical or demographic data. Aggregated Information may bederived from personal data, but may not considered personal data if it does not directly
or indirectly reveal your identity. For example, we may track the total number of visitors
to our Platform, or review Log Data, or track the number of visitors to each page of ourSite. We aggregate this data to calculate the percentage of users accessing a specificfeature of the Platform and analyze this data for trends and statistics.
However, if we or our third-party analytics service providers combine or connect
Aggregated Information with your personal data so that it can directly or indirectly
identify you, we treat the combined data as personal data, which will be processed inaccordance with this Privacy Policy. Please see our Cookie Policy for more information.

Payment Processing
We do not directly collect your payment information and we do not store your payment
information. We use third-party, PCI-compliant, payment processors, which collectpayment information on our behalf in order to complete transactions. While ouradministrators are able to view and track actual transactions via customer portals, we do
not have access to, or process, your credit card information.

Interactive and Public Spaces
The Platform may offer publicly accessible blogs, community forums, comments
sections, discussion forums, or other interactive features ("Interactive and Public
Spaces"). If you choose to participate in any of these Interactive and Public Spaces,
please be aware that any information that you post may be read, collected, and used byothers who access it. If you wish to remove your personal information from any of ourInteractive and Public Spaces, please contact us.

How Do We Use Personal Information That We
Collect
We use your personal information for a number of different reasons, as further
explained below.

In addition, for users located in the EEA and the UK, we must have a valid legal basis
in order to process your personal data. The main legal bases under the European
Union's General Data Protection Regulation (GDPR) that justify our collection and useof your personal information are:Performance of a contract — When your personal information is necessary to enter
into or perform our contract with you.
Consent — When you have consented to our use of your personal information via aconsent form (online or offline).
Legitimate interests — When we use your personal information to achieve a legitimate
interest and our reasons for using it outweigh any prejudice to your data protection
rights.
Legal obligation — When we must use your personal information to comply with ourlegal obligations.
Legal claims — When your personal information is necessary for us to defend,
prosecute or make a claim.
Below are the general purposes and corresponding legal bases (in brackets) for which
we may use your personal information:● Providing you access to and use of the Platform [depending on the context,
performance of a contract, legitimate interests, and in some cases, legal claims].
● Processing and completing transactions, and sending you related information,
including purchase confirmations and invoices and important notices [dependingon the context, performance of a contract or legitimate interests].
● Responding to your queries and requests, or otherwise communicating directlywith you [depending on the context, performance of a contract, legitimate
interests, and in some cases, legal claims].
● Improving the content and general administration of the Platform, including
system maintenance and upgrades, enabling new features and enhancing both
Site Visitor and Customer experience [legitimate interests].
● Detecting fraud, illegal activities or security breaches [legitimate interests].
● Providing our Services to our Customers [depending on the context, performanceof a contract or legitimate interests].
● Hosting or sponsoring Events [depending on the context, performance of acontract or legitimate interests].
● Ensuring compliance with applicable laws [compliance with a legal obligation].

● Conducting statistical analyses and analytics by monitoring and analyzing trends,
usage, and activities in connection with the Platform [consent where required(e.g. 3rd-party cookies), or legitimate interests].
● Increasing the number of customers who use our Platform through marketing andadvertising [consent where required, or legitimate interests].
● Sending commercial communications, in line with your communicationpreferences, about products and services, features, newsletters, offers,
promotions, and events [consent and in some cases, depending on location, withexisting customers, legitimate interests].
● Providing information to regulatory bodies when legally required, and only as
outlined below in this Privacy Policy [legal obligation, legal claims, legitimate
interests].

When We Share Information
We only disclose your personal information as described below.

Third-Party Service Providers
Vercel discloses users' information to our third party agents, contractors, or service
providers who are hired to perform services on our behalf. These companies do things
to help us provide the Platform, and in some cases collect information directly, forexample as explained in Payment Processing above. Below is an illustrative list offunctions for which we may use third-party service providers:
●
●
●
●
●
●
●
●
●
●

Hosting and content delivery network services
Analytics services
CRM providers
Lead generation partners
Marketing and social media partners
Customer support services
Payment processors
Hosting and content delivery network services
Functionality and debugging services
Professional service providers, such as auditors, lawyers, consultants,
accountants and insurers

Business Transfers
As we continue to grow, we may purchase websites, applications, subsidiaries, otherbusinesses or business units. Alternatively, we may sell businesses or business units,
merge with other entities and/or sell assets or stock, in some cases as part of areorganization or liquidation in bankruptcy. As part of these transactions, we maytransfer your personal information to a successor entity upon a merger, consolidation orother corporate reorganization in which Vercel participates, or to a purchaser or acquirerof all or a portion of Vercel's assets, bankruptcy included.

Vercel Customers
When we act on behalf of our Customers (as a data processor or service provider), wemay provide End Users' personal information to our Customers in order to comply with
their requests, End Users' requests and/or regulator requests, among others.
Occasionally, we will provide our Customers with aggregated information that does not
identify End Users directly, in order to provide information about usage, demographics(such as location) or other general information.

Event Sponsors
If you are an Event Attendee that has registered for an Event with Vercel, such as the
Next.js conference, we will provide your personal information to the Event sponsors.
Such Event sponsors may use your personal information for their own direct marketing
purposes and otherwise in accordance with the terms of the Event sponsors’ own
privacy policies.

Anonymized Information
We share aggregated, automatically-collected or otherwise non-personal information
with third parties for various purposes, including (i) compliance with reporting
obligations; (ii) for business or marketing purposes; (iii) to assist us and other parties inunderstanding our users' interests, habits and usage patterns for certain programs,
content, services, marketing and/or functionality available through the Platform. We do
not share personal information about you in this case.

Legal Obligations and Security
In addition, Vercel will preserve or disclose your personal information in limited
circumstances (other than as set forth in this Privacy Policy), including: (i) with yourconsent; (ii) when we have a good faith belief it is required by law, such as pursuant to a
subpoena, warrant or other judicial or administrative order (as further explained below);(iii) to protect the safety of any person and to protect the safety or security of our
Platform or to prevent spam, abuse, or other malicious activity of actors with respect to
the Platform; or (iv) to protect our rights or property or the rights or property of those
who use the Platform.

If we are required to disclose personal information by law, such as pursuant to a
subpoena, warrant or other judicial or administrative order, our policy is to respond torequests that are properly issued by law enforcement within the United States or via
mutual legal assistance mechanism (such as a treaty). Note that if we receive
information that provides us with a good faith belief that there is an exigent emergency
involving the danger of death or serious physical injury to a person, we may provide
information to law enforcement trying to prevent or mitigate the danger (if we have it), tobe determined on a case-by-case basis.

Links to Third Party Sites
This Privacy Policy applies only to the Platform. The Platform may contain links to otherwebsites not operated or controlled by Vercel ("Third Party Sites"). The policies andprocedures we describe here do not apply to Third Party Sites, and links to such Third
Party Sites on the Platform do not imply that Vercel endorses or has reviewed the Third
Party Sites. We suggest contacting those sites directly for information on their privacy
policies.

What You Should Know about Domain Registration
Note that if you purchase a domain name from Vercel, we may be required to collectregistrant data for the purposes of domain registration and listing via the WHOIS
protocol. We may also be required to share this with ICANN, the relevant registrars andother such providers with whom we contract in order to provide our domain nameservices, as well as when served with a legitimate request from third parties.
Registration data may include the domain name, registrant name and contact
information, and information on the domain name server. Such registration data may bemade publicly available by ICANN.

"Do Not Track"
Vercel does not respond to Do Not Track ("DNT") browser signals. For more information
on DNT settings generally, please visit https://allaboutdnt.com.

How to Change Your Communication Preferences
To keep your information accurate, current, and complete, please contact us as
specified below. We will take reasonable steps to update any information in ourpossession that you have previously submitted via the Platform. Note that you may also

manage your communications preferences and the receipt of any commercial
communication by clicking the "unsubscribe" link included at the bottom of all emails
from Vercel. You may also adjust your preferences through your account settings if you
have a Vercel account, or send an email to privacy@vercel.com.

Access and Accuracy
Vercel uses reasonable efforts to keep your personal information accurate. We will
provide you with online access to your personal information so that you may review,
update or correct personal information that we hold.
Note that in order to protect your privacy and security, we will also take reasonable steps
to verify your identity before granting you access or enabling you to make corrections.
To access your personal information, please visit the relevant account management
sections of our Platform. If you cannot access your personal information on the Platform,
please send an email to privacy@vercel.com.

How Long Do We Keep Your Personal information?
General Retention Periods
We use the following criteria to determine our retention periods:● The amount, nature and sensitivity of your information;● The reasons for which we collect and process the personal data;● The length of time we have an ongoing relationship with you and provide youwith access to our Platform; and● applicable legal requirements.
We retain personal information for as long as needed to provide our Services. Note,however, that with respect to our Customers with active accounts, we may retain certain
essential account information, but otherwise regularly delete other information that isless essential to the provision of our Services in order to minimize our storage of data.
We also will retain personal information that we've collected from you where we have an
ongoing legitimate business need to do so (for example, to comply with applicable legal,
tax or accounting requirements). Additionally, we cannot delete information when it isneeded for the establishment, exercise or defense of legal claims (also known as a"litigation hold"). In this case, the information must be retained as long as needed forexercising respective potential legal claims.

When we no longer have an ongoing legitimate business need to process your personal
information, we will either delete or anonymize it or, if this is not possible (for example,
because your personal information has been stored in backup archives), we willsecurely store your personal information and isolate it from any further processing until
deletion is possible.
For any questions about data retention, please contact privacy@vercel.com.

Anonymization
In some instances, we may choose to anonymize your personal data instead of deletingit, for statistical use, for instance. When we choose to anonymize, we make sure that
there is no way that the personal data can be linked back to you or any specific user.

Data Security And Integrity
We take steps that are reasonably necessary to securely provide our Platform. We have
put in place reasonably appropriate security measures designed to prevent yourpersonal data from being accidentally lost, used or accessed in an unauthorized way,altered or disclosed. We limit access to personal data only to those employees, agents,
contractors and the third parties who have a business need-to-know.
We also have procedures in place to deal with any suspected data security breach. If
required, we will notify you and any applicable regulator of a suspected data security
breach. We also require those parties to whom we transfer your personal information toprovide acceptable standards of security.
Notwithstanding, no Internet or email transmission is ever fully secure or error free. In
particular, email sent to or from the Services may not be secure. Therefore, take special
care in deciding what information you send to us via email. For any questions about the
security of your information, please contact privacy@vercel.com.

Your California Privacy Rights
If you are a California resident, California Civil Code Section 1798.83 permits you torequest in writing a list of the categories of personal information relating third parties towhich we have disclosed certain categories of personal information during the preceding
year for the third parties’ direct marketing purposes. To make such a request, pleasecontact us at privacy@vercel.com.

Notice to Nevada Consumers
We do not sell your personal information within the scope of, and according to thedefined meaning of, a "sale" under NRS 603A.

International Transfers
Vercel is a United States Delaware corporation with primarily storage of your informationin the United States and the EEA. To facilitate our global operations, we may process
personal information from around the world, including from other countries in which
Vercel has operations, in order to provide the Platform.
If you are accessing or using our Platform or otherwise providing personal
information to us, you are agreeing and consenting to the processing of yourpersonal information in the United States and other jurisdictions in which we
operate.
If you are a Customer, you are responsible for informing your End Users of how andwhere their personal data will be processed at the time of collection.
Vercel complies with the EU-U.S. and Swiss-U.S. Privacy Shield framework ("Privacy
Shield") as set forth by the U.S. Department of Commerce in connection with thecollection, use, and retention of certain personal data transferred from the EEA or the
UK and Switzerland to the United States. Although the EU-U.S. Privacy Shield has been
ruled invalid for the transfer of personal data, where personal information has alreadybeen transferred to the U.S. on the basis of the EU-U.S. Privacy Shield prior to being
held invalid, we will continue to protect personal information from the EEA or the UK
according to the standards of the Privacy Shield and applicable EU law. To learn more
about the Privacy Shield program, or to view our certification, please see
https://www.privacyshield.gov.
In addition to relying on our Privacy Shield certification with respect to personal datatransferred from the EEA or the UK for the time period in which the EU-US Privacy
Shield was valid or for data that we receive from Switzerland, Vercel relies on othermechanisms, including the Standard Contractual Clauses and consent, to transfer
personal data that we receive from the EEA or the UK to Vercel in the United States.
Security. We maintain security measures to protect personal data as described in thesection above entitled "Data Security And Integrity".

Access. Individuals in the EEA, the UK and Switzerland have certain rights to access,correct, amend, or delete personal data. Please see the section below entitled"Additional Information for Users in the EEA and the UK." for more information on therights of users in the EEA and the UK (and, to the extent applicable, users in
Switzerland). Note that when we process End Users' personal data as a data processor
on behalf of our Customers, we will process such requests pursuant to our contract withour customer and our customers' instructions.
Recourse, Enforcement, Liability. With respect to personal data collected fromindividuals in the EEA and the UK (while Privacy Shield was in place) or Switzerland, ,Vercel commits to resolve complaints about our processing of your personal data as set
forth in the principles under Privacy Shield. Individuals in the EEA and the UK and
Switzerland with inquiries or complaints should first contact Vercel by email at
privacy@vercel.com or via postal mail at 440 N Barranca Ave #4133, Covina, CA
91723, with the subject "Attention: Privacy Shield". We have further committed to referunresolved Privacy Shield complaints to an alternative dispute resolution provider. If you
have an unresolved privacy or data use concern that we have not addressedsatisfactorily, please contact our U.S.-based third-party dispute resolution provider (freeof charge) at https://feedback-form.truste.com/watchdog/request. For additional
information, please visit https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
We are subject to the investigatory and enforcement powers of the Federal Trade
Commission with respect to personal data received or transferred pursuant to the
Frameworks.

Additional Information for Users in the EEA and theUK.
If the GDPR applies to you because you are in the EEA or the UK, you have certain
rights in relation to your personal data:
The right to be informed: our obligation to inform you that we process your personal
data (and that's what we're doing in this Privacy Policy);
The right of access: your right to request a copy of the personal data we hold aboutyou (also known as a 'data subject access request');
The right of rectification: your right to request that we correct personal data about you
if it is incomplete or inaccurate (though we generally recommend first making any
changes in your Account Settings);

The right to erasure (also known as the 'right to be forgotten'): under certain
circumstances, you may ask us to delete the personal data we have about you (unless it
remains necessary for us to continue processing your personal data for a legitimate
business need or to comply with a legal obligation as permitted under the GDPR, inwhich case we will inform you);
The right to restrict processing: your right, under certain circumstances, to ask us tosuspend our processing of your personal data;
The right to data portability: your right to ask us for a copy of your personal data in acommon format (for example, a .csv file);
The right to object: your right to object to us processing your personal data (forexample, if you object to us processing your data for direct marketing); andRights in relation to automated decision-making and profiling: our obligation to betransparent about any profiling we do, or any automated decision-making.
These rights are subject to certain rules around when you can exercise them.

Customers, Site Visitors and Event Attendees in the EEA or theUK.
If you are located in the EEA or the UK and you are a Customer, Site Visitor or Event
Attendee, and wish to exercise any of the rights set out above, you may contact us at
privacy@vercel.com using the term "DSR" as your email subject line.
You will not have to pay a fee to access your personal data (or to exercise any of theother rights) unless your request is clearly unfounded, repetitive or excessive.
Alternatively, we may refuse to comply with your request under those circumstances.
If we cannot reasonably verify your identity, we will not be able to comply withyour request(s). We may need to request specific information from you to help us
confirm your identity. This is a security measure to ensure that personal data is notdisclosed to any person who has no right to receive it. Note that this is especially true
when you engage a third party to assist you in exercising your rights.
We will respond to all legitimate requests within one month. Occasionally it may take us
longer than a month if your request is particularly complex or you have made a number

of requests. In this case, we will notify you and keep you updated as required by law. In
addition, we will always balance your rights against those of other data subjects inconnection with any requests, and in some cases this may require us to redact our
responses or deny a request.
Customers also can access, correct, export, or update their Account Information byediting their profile or organization record at https://vercel.com. We ask that Customers
use this option as a first step when rectifying information.
If you no longer wish to receive our marketing/promotional information, we remind youthat you may withdraw your consent to direct marketing at any time directly from theunsubscribe link included in each electronic marketing message we send to you. If you
do so, we will promptly update our databases, and will take all reasonable steps to meetyour request at the earliest possible opportunity, but we may continue to contact you tothe extent necessary for the purposes of providing our Services.
Finally, you have the right to make a complaint at any time to the supervisory authority
for data protection issues in your country of residence. We would, however, appreciate
the chance to address your concerns before you approach the supervisory authority, so
please contact us directly first.

End Users in the EEA or the UK.
Vercel has no direct relationship with End Users. Our Customers are solely
responsible for ensuring compliance with all applicable laws and regulations withrespect to their End Users, and this includes handling all data subject requests.
We rely on our Customers to comply with the underlying legal requirements and responddirectly to End Users when End Users wish to exercise the rights set forth above.
However, if an End User sends a request to Vercel to access, correct, update, or delete
his/her information, or no longer wishes to be contacted by a Customer that uses ourServices, we will direct that End User to contact the Customer's website(s) with which
he/she interacted directly, and cooperate with our Customers as required by applicablelaw in order to ensure that our Customers satisfy their End Users' requests.

European Representative
Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Vercel has
appointed European Data Protection Office (EDPO) as its GDPR representative in the
EU. You can contact EDPO regarding matters pertaining to the GDPR by:

● Using EDPO's online request form at https://edpo.com/gdpr-data-request/; or● Writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.

UK Representative
Pursuant to the UK GDPR, Vercel has appointed EDPO UK Ltd as its UK GDPR
representative in the UK. You can contact EDPO UK regarding matters pertaining to the
UK GDPR:● Using EDPO's UK online request form at https://edpo.com/gdpr-data-request/; or● Writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United
Kingdom.

Contact Us
If you have any questions or suggestions regarding this Privacy Policy, please contact
us at privacy@vercel.com.

Last updated: March 15, 2021