SMARTSHEET PRIVACY POLICY
Last Updated: April 28, 2017
At Smartsheet, we value your privacy and respect your interest in knowing how information about you is collected and used. This
policy ("Privacy Policy") describes how Smartsheet Inc. (“Smartsheet” or “we”) collects, uses and discloses personal and otherinformation we gather through our websites (including www.smartsheet.com), our mobile applications, and the Smartsheet work
collaboration platform (“Platform”). We will refer to these collectively as the “Sites”. This Privacy Policy also describes your choices
regarding our use of your personal information and how you can access and update this information. When we refer to “Services”,
we mean the Sites and the services available through them.
The Smartsheet Privacy Shield Notice (“Privacy Notice”) is contained in the final section of this Privacy Policy.
This Policy explains:
1. The Information We Collect
2. How We Use the Information
3. How We Share Information
4. Our Use of Cookies and Other Tracking Technologies
5. Updates and Access to Personal Information
6. Closing Your Account; Data Retention
7. How We Protect Your Information
8. Marketing Choices
9. Blogs; Forums
10. Linked Sites; Third Party Widgets
11. Privacy Shield Notice

1. The Information We Collect
Information We Collect Directly from You. We collect certain personal information that you provide directly to us. For example, wecollect your name, email address, and a password when you register with us, as well as other information you choose to share suchas employment information, demographic information, contacts from an email account address book, and profile image. If you sign
up for a paid subscription, we collect payment information which may include credit card number. We will also collect information
you share in communications with us through or relating to the Services; for example, during surveys, contests, phone calls (including
call recordings), online chat discussions, “Contact Us” invitations and similar forms within the Services, or if you refer a friend to theServices (see the “Referrals” section below).
Information We Collect From Your Employer. If you use the Services through an enterprise account, your employer will provide
Smartsheet with information about you including your name and email address. Your employer may also upload your profile image,position details, profile or directory information, and other contact information.
Information We Collect from Your Third-Party Accounts. You may be able to log into the Sites using third-party provided, single signon services such as Google OpenID, Skype, and Microsoft Single Sign-On. If these services are used to authenticate your identity, youwill be asked to share certain personal information with us, such as your name, email address, and other information as indicatedwhen you authenticate your log in; we may also request or allow you to share other information, such as your image, from theseaccounts.
Information We Collect Automatically. We automatically gather information about your use of the Services through cookies, web
beacons, java script, log files and other technologies. For example, we may automatically collect: your domain name, browser type,device type and operating system; page views and links you click within the Services; IP address, device ID or other identifier; location
information; date and time stamp, and time spent using the Services; referring URL; and your activity within the Services. We may

combine this information with other information we have collected about you, including your user name, name, and other personal
information. Please see the “Cookies and Other Tracking Technologies” section below for more information.
Content. The Services permit users to share and manage information by creating, uploading, and attaching information (“Content”)
to "sheets" that can be shared, stored and accessed through the Platform. We have no control over the information contained within
Content, including any personal information. The term “Content” does not include usage information we collect about how users
access, create, share and manage Content (e.g., file sizes or access logs). For more information about Content, please refer to theagreement that governs your use of the Services.
2. How We Use Information. To explain how we use information we collect from our Sites, we distinguish between Content and allother information gathered.
Information We Collect. Without your consent, we will not use the information about you and your use of the Services that we collect(as described above) except:• To provide the Services to you.
• To communicate with you through email and other methods about your use of the Services and in the provision of customer
service to you; this may include responding to your inquiries, fulfilling your orders, or providing technical support.
• To tailor content we send or display to you in order to offer location customization and personalized help and instructions, andto otherwise personalize your experience using the Services.
• For direct marketing and promotional purposes (unless you have opted out); for example, we may use contact information suchas your email address to send you newsletters, special offers, or promotions, or to otherwise contact you about Smartsheet or
third party products or information we think may interest you. As explained above, we do not use Content for this purpose. You
may opt out of receiving marketing emails by following the opt-out instructions in the email or emailing privacy@smartsheet.com.
We may still email customer service and transaction-related communications, even if you have opted out of receiving customer
satisfaction surveys.
• To assist in advertising the Services on third party websites.
• To protect the Services; for example, to investigate and enforce violations of our policies and terms of use or other abuses of
the Services.
• To better understand how users access and use our Services in order to improve our Services (which may include developing
additional products and services) and for other research and analytical purposes. As part of this, we may collect and analyze usage
details (e.g., storage size used, access logs, etc.) related to Content; however, we do not actually access Content for these
purposes.
• To comply with the law or legal proceedings; for example, we may disclose information in response to lawful requests by publicauthorities, including responding to national security or law enforcement disclosure requirements.
Content. We will only access Content as necessary to:• Respond to customer support requests (including, with respect to enterprise users, company administrator requests).
• Comply with the law or legal proceedings; for example, we may disclose Content in response to lawful requests by publicauthorities, including responding to national security or law enforcement disclosure requirements.
• Investigate, prevent, or take action against suspected abuse, fraud, or violation of our policies and terms.
Aggregated Data. We may use information about your use of our Services to produce reports of aggregated, de-identified data(“Aggregated Reports”). Aggregated Reports will include data not identifiable or attributable to you and will only be used for
Smartsheet’s internal business purposes; for example, to help us improve our Services, develop new offerings or uses, or for other
Smartsheet Privacy Policy

2internal research and analyses purposes. Information about Content may contribute to an Aggregated Report (e.g., we may gather
data about the length of Content entered into a cell to determine whether we need to increase the space available to users) but wewill never access Content in violation of this Policy to create an Aggregated Report.
Sensitive Data. We have no control over whether you include any Sensitive Data in your Content. However, we do not intentionallycollect, and will not request, Sensitive Data from you. If a Smartsheet employee discovers that we have received Sensitive Data fromyou, it will inform a designated contact within our company who will assess the processing of such data. “Sensitive Data” means
personal information that discloses your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union
membership, or data concerning health.
3. How We Share Information
We will not sell the information we collect about you to a third party or allow a third party to use that information for its marketing
purposes. We may share information that we collect about you - including personal information – with your consent, at your request,
or as follows:Enterprise Customers. Smartsheet is a data processor with respect to Content and other user information we collect in providing theServices to our enterprise account customers. Accordingly, if you use the Services under an enterprise-level account, Content andother information associated with your account may be disclosed to the enterprise upon request by the enterprise or by anadministrator on the enterprise account. Further, if the email address under which you have registered with us belongs to an
enterprise or organization (with the exception of known ISP email providers such as Gmail), we may disclose your email address andaccount information to that organization in order to help it understand who in the organization is using Smartsheet.
Users of the Services. Content that you choose to share with, or make available to, other users is shared as designated by you, andyou should consider that it may be further shared by your collaborators; we are not responsible for, nor does this Policy apply to, thecollection, use, processing, or sharing of Content by other users in this manner. Also, some of the features and functionality of theServices involve disclosure of your account profile information to other users of the Services; for example, your name, email address,
and profile image may be displayed when a user views all the collaborators on a “sheet” as well as the history details of that sheet(e.g., user, access/edit, date and time stamp).
Resellers/AP Processors. If you sign up for certain products or services (such as a free trials) and you are located outside the U.S., wemay share your information with a Smartsheet reseller so they can contact you about our products, services and offers. We will give
you to opportunity to opt of such sharing when you sign up for the applicable product or service. If you purchase access to the Services
through a reseller (regardless of location), we may share certain information about your account and feature usage with the reseller(or their affiliate) in furtherance of their relationship with you. If you use a third party to facilitate your payment obligations, we will
share certain account-usage and billing-related information about your account with such third party for billing and businessadministration purposes.
Referrals. When you refer a friend who later signs up for the Services, we may contact you about the successful referral to provide
you a referral credit.
Testimonials. With your consent, we may publish customer testimonials you share with us, which could contain personally identifiable
information such as your name. If you want to remove a testimonial, please send your request to support@smartsheet.com.
Service Providers. We may share information about you with third party vendors, consultants and other service providers who are
working on our behalf or providing services to us. For example, we may use third party payment processors to assist us in taking
payment for use of the Services. We obtain appropriate contractual and technical protections to limit these service providers’ use anddisclosure of any information about you that we share with them.
Required by Law. We release information about you if we believe we must do so to comply with the law or a subpoena, bankruptcy
proceeding, or similar legal process.
Protection of Rights. We may disclose information about you, such as your name, contact information, and billing information, toenforce our agreements with you or to protect the rights and safety of Smartsheet, our customers, our individual users and the generalpublic, or as evidence in litigation in which we are involved.

Smartsheet Privacy Policy

3

Business Transactions. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may
be transferred to the acquiring entity as part of the transaction, and may also be reviewed as part of the due diligence review for thetransaction. For example, we may need to provide a list of all customer accounts and payment histories.
Aggregate and Anonymized Information. We may share aggregate or anonymized information about users with third parties formarketing, advertising, research or similar purposes. For example, if we display advertisements on behalf of a third party, we may
share aggregate, demographic information with that third party about the users to whom we displayed the advertisements.
4. Our Use of Cookies and Other Tracking Technologies
We use cookies, java script, log files, clear GIFs and other mechanisms to gather information about your use of the Services, which we
may combine with other personal information we collect from you. Currently, our systems do not recognize browser “do-not-track”
requests. You may, however, disable certain tracking (e.g., by disabling cookies or opting out of ad networks).
Cookies. Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your web browser for recordkeeping purposes. We might use cookies to uniquely identify you, to help us to process your transactions and requests, to track
aggregate and statistical information about user activity, and to display advertising both on our Sites and on third-party sites. The“help” portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to havethe browser notify you when you receive a new cookie, or how to disable cookies altogether. If you disable cookies, be aware thatsome features of our Sites may not function.
Clear GIFs. Clear GIFs (a.k.a. web beacons or pixel tags) are tiny graphics with a unique identifier, similar in function to cookies. In
contrast to cookies, clear GIFs are embedded invisibly on web pages, and are not stored on your hard drive. We might use clear GIFs
to track the activities of Site visitors and users of our applications, to help us manage content, and to compile statistics about usage.
We and our third party service providers also might use clear GIFs in HTML e-mails to our customers, to help us track e-mail response
rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.
Third-Party Analytics. We also use automated devices and applications, such as Google Analytics (more info here) and Optimizely(more info here) to evaluate use of our Services. We use these tools to gather non-personal information about users to help us improve
our Services and user experiences. These analytics providers may use cookies and other technologies to perform their services, andmay combine the information they collect about you on our Sites with other information they have collected for their own purposes.
This Policy does not cover such uses of data by third parties.
Behavioral Targeting and Remarketing. We use advertising platforms, including but not limited to: Google Ads/DoubleClick (moreinfo here), Facebook Custom Audience (more info here), LinkedIn Marketing (more info here), Microsoft/Bing (more info here) andMarketo (more info here), to display ads as part of our advertising campaigns. As a result, our ads may be displayed to you on a search
results page or on third party sites. Our advertising partners use cookies and other technologies to collect information about youractivities on our Services and other sites to provide you targeted advertising based upon your interests. We may share your email
address or other information with our advertising partners to assist us in reaching you with more relevant content outside of the Sites.
Further, these third parties may collect your IP address or other device identifiers and combine the information they collect on ourSites with information about your visits to other sites, to create market segments that they will use to more effectively advertise ourservices and those of other advertisers. If you wish to not have this cross-site information used for the purpose of serving you targeted
ads, you may opt-out of many ad networks by clicking here (or if located in the European Union, click here). You will continue to receive
ads on the sites you visit, but the ad networks from which you have opted out will no longer target ads to you based upon youractivities on other sites. Please note, however, that these opt-out mechanisms are cookie based; so, if you delete cookies, block cookies
or use another device, your opt-out will no longer be effective. For more information, go to www.aboutads.info.
5. Updates and Access to Personal Information
Accessing and Updating Your Account Information. Individual users may log in and use the Account Administration settings or email
us at support@smartsheet.com to access or update account profile information. Enterprise users may login log in and use the Account
Administration settings or contact an administrator of the organization’s account to access or update account profile information.
Smartsheet will support its enterprise customers as needed to update an individual’s account information.
Content. Smartsheet is not able to change or delete any information - personal information or otherwise – contained in Content(including that of another user). To request access to such information, you should contact the user or enterprise who owns the
Smartsheet Privacy Policy

4relevant Content. Individuals located in the European Economic Area (EEA) have additional rights regarding access to personal data,
and limiting use and disclosure of such data. With our Privacy Shield certification (see below for more information), Smartsheet has
committed to respect those rights. However, our personnel have limited ability to access Content that is submitted to our Services. If
you wish to request access, to limit use, or to limit disclosure of your personal information contained in Content, please provide thename of the user who submitted your information to our Services. We will refer your request to that user, and will support them as
needed in responding to your request.
6. Closing Your Account; Data Retention
Closing Your Account. If you wish to close your account, you may do so by logging in and using the Account Administration settings orby emailing us at support@smartsheet.com. If you shared any Content or information through our Services with other users, suchContent or information will continue to be accessible to such users.
Data Retention. We will retain your account information and Content while your account is active, and after as otherwise necessary
for our legitimate business purposes (such as record keeping, accounting, fraud prevention and other business administrative
purposes, or where required by law).
7. How We Protect Your Information
We have implemented safeguards to protect the information we collect, including Content and personal information. However, no
company, including Smartsheet, can guarantee the absolute security of Internet communications. If you have any questions pleaserefer to our Security page, or you can contact us at support@smartsheet.com.
8. Marketing Choices
Customers can opt out of being contacted by us for marketing or promotional purposes by following the opt-out instructions locatedin the e-mails we send, by changing the account privacy settings, or by emailing us at privacy@smartsheet.com.
If you opt out of marketing communications, Smartsheet will continue to send you transactional or service-related communications,such as service announcements and administrative messages. If you do not wish to receive these, you have the option to cancel youraccount by logging in and using the Account Administration settings or by emailing us at support@smartsheet.com.
9. Blogs; Forums
Our Sites may contain publicly accessible blogs and community forums. Be aware that any information you provide in these areas may
be read, collected, and used by others who access them. To request removal of your information from our blog or community forum,
contact us at support@smartsheet.com. In some cases, we may not be able to remove your information; if that happens, we will let
you know why.
10. Linked Sites; Third Party Widgets
Links to Other Websites. Our Services include links to other websites with privacy practices that may differ from ours. Any information
you submit to a website not belonging to Smartsheet is governed by that site’s privacy statements, not this one. We encourage you
to carefully read the privacy statement of any website you visit.
Plugins and Social Media Widgets. Our Sites may include social media features and widgets (collectively “Widgets”), such as a "sharethis" button or other interactive mini-programs that run on our Services. Widgets can be used to provide you specific services fromother companies (e.g., displaying the news, opinions, music, etc.). Personal information, such as your email address, may be collected
through the Widgets. Cookies may also be set by the Widgets to enable them to function properly. Widgets displayed on our Sites are
not hosted by Smartsheet and are subject to the privacy policies of the third-party company providing the Widget, and not this Policy.
11. International Transfers and Smartsheet Privacy Shield NoticeInternational Transfer of Data. We are based in the United States and the information we collect is governed by U.S. law. The
information we collect may be transferred to, used from, and stored in the United States or other jurisdictions in which Smartsheet,
Smartsheet Privacy Policy

5our affiliates or service providers are located; these jurisdictions (including the United States) may not guarantee the same level ofprotection of personal information as the jurisdictions in which you reside. By using the Services, you acknowledge and agree to any
such transfer of information outside of the jurisdiction in which you reside.
U.S.-EU Privacy Shield and U.S-Swiss Privacy Shield Certifications. Smartsheet participates in and has certified its compliance with
the EU-U.S. and US-Swiss Privacy Shield Frameworks and Principles (collectively, the “Privacy Shield Principles”). Smartsheet willcomply with the Privacy Shield Principles with respect to the personal information we receive in the Unites States from the European
Economic Area and Switzerland. You can review the Privacy Shield Principles, learn more about Privacy Shield, and view our Privacy
Shield certification at https://www.privacyshield.gov/. Smartsheet’s commitments under the Privacy Shield are subject to theinvestigatory and enforcement powers of the United States Federal Trade Commission.
Law Enforcement Requests. In certain situations, we may be required to disclose personal data in response to lawful requests by
public authorities, including to meet national security or law enforcement requirements.
Onward Transfers. Third parties who process personal information on our behalf must agree to use such personal information only
for the purpose for which it is provided by us and they must contractually agree to provide adequate protections for personal
information. Smartsheet will continue to be liable for any onward transfers of personal information to such third parties.
Complaints or Questions About Our Privacy Shield or Safe Harbor Certifications. If you have any questions or complaints regarding
our Privacy Shield or Safe Harbor Certification, you may contact us at privacy@smartsheet.com. We will promptly investigate andattempt to resolve any complaints, and will respond to you within 45 days of receiving any such complaint. If you are a user located in
the EEA whose complaint cannot be resolved through this process, we will participate in the dispute resolution process administeredby TRUSTe. For information about how to initiate a Privacy Shield claim with TRUSTe, please contact TRUSTe at https://feedbackform.truste.com/watchdog/request. Under certain conditions (which are described on the Privacy Shield website), you may invoke
binding arbitration when other dispute resolution procedures have been exhausted.
12. Changes to this Policy
We may update this Policy to reflect changes to our privacy practices. If you are a Smartsheet customer and we make any materialchanges that affects the way we treat information that we have previously collected from you, we will notify you by email (sent to thee-mail address specified in your account) or by means of a notice on our Platform prior to the change becoming effective. We
encourage you to periodically review this Policy for the latest information on our privacy practices.
13. How to Contact Us/Dispute Resolution
Questions regarding this Policy or our privacy practices should be directed to privacy@smartsheet.com, or by regular mail addressedto Smartsheet Inc., Attn.: Legal Department, 10500 NE 8th Street, Suite 1300, Bellevue WA 98004.
If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third
party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Smartsheet Privacy Policy

6