SMARTSHEET PRIVACY POLICY
Last Updated: May 22, 2018
At Smartsheet, we value your privacy and respect your interest in knowing how information about you is collected
and used. This privacy policy (“Policy”) describes how we collect, use, and disclose information that we gather
about visitors to our websites, including www.smartsheet.com (collectively, “Sites”), and from users of theSmartsheet work collaboration platform (“Platform”), the Smartsheet mobile applications (collectively, “Apps”), as
well as our services available through the Sites, Apps, and Platform (collectively, “Services”), and the information
we collect when we communicate with customers, users, or other individuals related to the Services (whether byphone, email, or other method). This Policy also outlines your rights and choices with regard to the informationcollected about you. Please click on a topic below to learn more:
1. “Content” vs. Other Information
2. Other Information We Collect
3. Access to Content
4. Purposes for Which We Use Personal Data
5. How We Share Information
6. Use of Cookies, Tracking Technologies, Analytics, and Behavioral Marketing
7. Your Choices and Rights
8. Data Retention
9. How We Protect Your Information
10. Blogs; Forums
11. Linked Sites; Third Party Widgets
12. Children
13. International Transfers and Privacy Shield Notice
14. Changes to this Policy
15. How to Contact Us/Dispute Resolution
16. English Version Controls
Who are “we”?: This Policy sets out how Smartsheet Inc. and our affiliated companies (together, “Smartsheet” (or“we”) handles your personal data. Smartsheet Inc. is the data controller for your personal data. Where processingof personal data is undertaken by our affiliated companies, they are joint controllers with Smartsheet Inc. for yourpersonal data. Our current affiliate controller is: Smartsheet UK Ltd., c/o Codebase, Argyle House, 3 Lady Lawson
Street, Edinburgh, EH3 9DR. Correspondence can be directed to Jonathan McCrimmond(jonathan.mccrimmond@smartsheet.com).
Who are “you”?: This Policy applies to any visitor to our Sites; users of the Services; individuals who contact us orwith whom we communicated via phone, email, or otherwise; and Customers, including both free trial and paid
account holders.
To EU Residents: Smartsheet processes your personal data in accordance with the EU data protection legislation,
including national or international legislation implementing the EU Data Protection Directive (until superseded),
the Privacy in Electronic Communications (“ePrivacy”) Directive (EU), and the General Data Protection Regulation(EU) 2016/679 (“GDPR”), as amended or superseded.

1. “Content” vs. Other Information.
Our Services permit Customers to share and manage information by creating, uploading, and attaching what wecall “Content” to sheets that can be shared, stored, and accessed through the Site. In this Policy, we distinguishbetween Content and all other information about you. We have no control over the information contained within

Content, including any personal data. Content does not include usage information we collect about how users
access, create, share, and manage Content (e.g., file sizes or access logs). Smartsheet is a data processor of theContent, and will only process personal data from the Content on behalf, and under the instructions, of ourCustomers (the data controllers) or where otherwise required by applicable laws. For more information about
Content, please refer to the agreement that governs your use of the Services.
Sensitive Data. We have no control over whether Sensitive Data is contained in Content. However, we do notintentionally collect - and will not request - Sensitive Data. If a Smartsheet employee discovers that we havereceived Sensitive Data, the employee will inform a designated contact within our company who will assess theprocessing of such data. “Sensitive Data” means personal data that discloses an individual’s racial or ethnic origin,political opinions, religious or philosophical beliefs, trade-union membership, criminal proceedings, biometrics,
and data concerning health.
2. Other Information We Collect About You.
This section describes information that is not Content.
We collect personal data about you directly from you, from others (e.g., your employer if you use an enterpriseaccount), and automatically when you use the Services. If the personal data we process is needed to comply withlaw, or to enter into or perform an agreement with you, we will inform you accordingly at the time of such datacollection. If we cannot collect this data, we may be unable to on-board you as a customer or provide products orservices to you.
Information We May Collect Directly from You.
At Account Creation. An email address is required to provision a new Smartsheet account (paid or trial). Without
this, we are unable to create your account. You may choose to provide other information at account creation,
including contact information (full name, phone number, etc.), employment details (company name/size, your job
title, etc.), and a system administrator’s email (if not you).
When Enhancing Your Profile. Account-related information described above can be added in the Platform or
through the Community Features to enhance your profile. You may also choose to add a profile image or to importcontacts from an address book.
When Purchasing Services. If you purchase a paid subscription, you may need to provide us billing and payment
information, including full name, company name, billing/shipping address, and credit card number. If you do notprovide us this information, you may be unable to subscribe and your access to our Services may be limited.
When Attending Events. We may collect or otherwise receive personal data such as your name, address, phone
number, and email when you register for or attend an event where Smartsheet in a sponsor or participant.
In Online Submissions. We collect information through interactive features of our Sites - e.g., when you submit
online forms; participate in surveys, contests, promotions, or sweepstakes; join online chat discussions; request
customer support; respond to “Contact Us” invitations; submit testimonials; or if you refer a friend (see Referrals).
Personal data gathered may include contact information (full name, phone number, email, etc.), employment
details (company name/size, job title, etc.), information about your use of Smartsheet, and any other information
you choose to share.
In Other Communications. You may share information in communications with us relating to the Services,
including during phone calls (and call recordings), chats, or over email. Personal data gathered may include contact
information, employment details, user preferences, and any other information you choose to share. Please only
provide us personal data that we need in order to respond to your request.

Information We Collect From Your Employer. If you use the Services through an enterprise account, your employer
will provide Smartsheet your email address in order to provision your account. Your employer may choose to shareadditional information about you including your profile image, contact information (e.g., full name, phone number,etc.), and employment details (e.g., job title).
Information We Collect From Third Parties.
When Purchasing Services. A third-party intermediary is used to manage credit card processing. It is not permitted
to store, retain, or use your billing information for any purpose except for credit card processing on our behalf.
From Your Third Party Accounts. You may choose to allow Smartsheet to access information from accounts you
have with other providers:Single Sign-On. You may be able to log into the Sites using third-party provided, single sign-on services such as
Google OpenID, Skype, and Microsoft Single Sign-On. If these services are used to authenticate your identity, youwill be asked to share certain personal data with us, such as your name, email address, and other information as
indicated when you authenticate your log-in; we may also request or allow you to share other information, such as
your image, from these accounts.
Integrations. Our Sites may provide access via connectors and integrations (“Integrations”) to your third party
accounts such as Slack or Facebook. Integrations can be used to pull and/or push information in and out of the
Platform, and to enable the applicable third party to receive notifications, such as sheet updates, from the Service.
Any information you authorize to be transferred from the Platform for the purposes of an Integration is governedby the third party’s privacy statement, not this one. We encourage you to carefully read the privacy statement of
any third party you authorize to receive information from the Platform.
Third Party Sources. Subject to applicable laws, we may gather information about you from lead-sharing tools
including LinkedIn Lead Generation, or as leads from Smartsheet’s global resale partners, as well as public
information - including internet searches relating to you or your company - in order to better service your accountand to provide more relevant assistance and marketing.
Information We Collect Automatically. We gather information about your use of the Services through cookies, web
beacons, java script, log files, database lookup, pixels, and other technologies. We may automatically collect: yourdomain name, browser type, browser language preference, device type and operating system; page views andlinks you click within the Sites; IP address, device ID, or other identifier; location information; date and time stamp,
and time spent using the Services; referring URL; and your activity within the Sites. We may combine thisinformation with other information we have collected about you, including your user name, name, and otherpersonal data. See “Use of Cookies, Tracking Technologies, Analytics and Behavioral Marketing” for details.
3. Content.
Our Customers are responsible for ensuring that Content is collected and handled (including any personal data
therein) in compliance with applicable laws. As a processor, we handle Content as directed by our Customers (thecontrollers), pursuant to our relevant customer agreements. We only access Content as necessary to:• Respond to customer support requests (including, with respect to enterprise users, company
administrator requests).
• Comply with the law or legal proceedings; for example, we may disclose Content in response to lawful
requests by public authorities, including responding to national security or law enforcement disclosure
requirements.
• Investigate, prevent, or take action against suspected abuse, fraud, or violation of our policies and terms.

4. Purposes for which We Use Personal Data
We use the personal data we collect under this Policy in furtherance of our legitimate business interests, which
include:
•

•

•
•

•
•

•

•

•

Provision of Services: To provide and operate our Services, fulfill your orders and requests, process yourpayments, for bug and error reporting and resolution, to perform upgrades and maintenance, and for similar
purposes.
Customer Support: To communicate with you about your use of the Services; respond to yourcommunications, complaints and inquiries; provide technical support; and for other customer service andsupport purposes.
Personalization: To tailor content we send or display to you in order to offer location customization andpersonalized help and instructions, and to otherwise personalize your experience using the Services.
Marketing and Promotions: For direct marketing and promotional purposes. For example, we may use
contact information such as your email address to send you newsletters, special offers or promotions, or tootherwise contact you about Smartsheet products or information we think may interest you. As explained
above, we do not use Content for direct marketing purposes. If you are located in a jurisdiction that requires
opt-in consent to receive electronic marketing messages, we will only send you such messages if you opt-in
to receive them. You may opt out of receiving marketing emails by following the opt-out instructions in theemail or emailing privacy@smartsheet.com. We may still email customer service and transaction-related
communications, even if you have opted out of receiving marketing communications.
Advertising: To assist in advertising the Services on third party websites.
Analytics and Improvement: To better understand how users access and use the Services, and for otherresearch and analytical purposes, such as to evaluate and improve the Services and to develop additional
products, services, and features. While we may collect and analyze usage details (e.g., storage size used,
access logs, etc.) related to Content, we do not actually access Content for these purposes.
Protect Legal Rights and Prevent Misuse: To protect the Services; prevent unauthorized access and othermisuse; and where we believe necessary to investigate, prevent, or take action regarding illegal activities,
suspected fraud, situations involving potential threats to the safety of any person, or violations of our Termsof Use or this Policy.
Comply with Legal Obligations: To comply with the law or legal proceedings; for example, we may disclose
information in response to lawful requests by public authorities, including responding to national security orlaw enforcement disclosure requirements.
General Business Operations: Where necessary to the administration of our general business, accounting,recordkeeping, and legal functions.

Purpose of Processing /Legitimate
Business Interests (see above)
Provision of Services

Legal Bases of Processing (EU Users)*••

Necessary to Enter into or Perform a Contract with You(upon your request, or as necessary to make the Services
available)
Our Legitimate Business Interests*••

Our Legitimate Business Interests**
With Your Consent

•
•
•
•

Our Legitimate Business Interests**
With Your Consent
Compliance with law
Establish, defend, or protect of legal interests•

Our Legitimate Business Interests**

Customer Support

Personalization
Marketing and Promotions
Advertising
Analytics and Improvement
Protect Rights and Prevent Misuse
Comply with Legal Obligation
General Business Operations

• Establish, Defend or Protect Legal Interests• Compliance With Law*For the personal data from the EU that we process, this column describes the relevant legal bases for suchprocessing under GDPR (and local implementing laws of EU member states); this does not limit or modify the
obligations, rights, and requirements under the privacy laws of non-EU jurisdictions.
** For the personal data from the EU, the processing is in our legitimate interests, which are not overridden by
your interests and fundamental rights. Marketing to EU data subjects is done only with opt-in consent.
5. How We Share Information
We will not sell information about you to a third party or allow a third party to use information we provide for its
own marketing purposes. We may share information about you with your consent, at your request, or as follows:
Corporate Users
Content and Usage. Smartsheet is a data processor with respect to Content and certain other user information wecollect in providing the Services to our corporate customers. This means: (a) the corporate Customer controls theinformation and determines how it may be used, and (b) we will process this information only under the written
instructions of our Customer or where otherwise required by applicable laws. So, if you use the Services under acorporate account, Content and other information associated with your account (e.g., who has accessed, shared,
amended, created, edited, or deleted Content) may be disclosed to the corporate Customer or an administrator on
for the corporate Customer account.
Account Discovery. If the email address which you used to register with us belongs to a corporate entity (with the
exception of known ISP email providers such as Gmail), we may disclose your email address and accountinformation to (a) users associated with that entity if you are a plan administrator in order to help those users
contact you, and (b) the entity and its Smartsheet plan administrators in order to help them understand who in theorganization is using Smartsheet.
To Other Users of the Services
Content. Content you choose to share with, or make available to, other users is shared as designated by you, andyou should consider that it may be further shared by your collaborators; we are not responsible for, nor does thisPolicy apply to, the collection, use, processing, or sharing of Content by other users in this manner.
Other Information. Some of the features and functionality of the Services involve disclosure of your personal data
to other users of the Services; for example, your name, email address, and profile image may be displayed when auser views collaborators on a “sheet” and users may see the history details on a sheet (e.g., your email,access/edits, date and time stamp, etc.).
To Resellers/Payment Processors. If you sign up for certain products or services (such as a free trials) and you arelocated outside the U.S., we may share your information with a Smartsheet reseller so they can contact you about
our products, services, and offers. We will disclose such sharing when you sign up for the applicable product orservice, and will, where required by law, obtain your consent. If you purchase access to the Services through areseller (regardless of location), we may share certain information about your account and feature usage with thereseller (or their affiliate) in furtherance of their relationship with you. If you use a third party to facilitate yourpayment obligations, we will share certain account-usage and billing-related information about your account withsuch third party for billing and business administration purposes. Resellers and payment processors are
independent data controllers of your personal data.

When Processing Referrals. When you refer a friend who later signs up for the Services, we may contact you about
the successful referral to provide you a referral credit.
In Testimonials. With your consent, we may publish Customer testimonials you share with us, which could containpersonal data such as your full name and other information you choose to share. If you wish to update or remove
your testimonial, please notify us at https://www.smartsheet.com/gethelp.
Through Use of Community Features. Our Sites may include interactive features, including forums, online
communities, bulletin boards and publicly accessible blogs (“Community Features”). You should be aware that any
information that you post in a Community Feature might be read, collected, and used by others who access it. To
request removal of your personal data from a Community Feature, contact us athttps://www.smartsheet.com/gethelp. We will make commercially reasonable efforts to remove your personal
data from our Sites, and will let you know if we are unable to do so and why.
To Our Service Providers. We may share information about you with third party vendors, consultants and otherservice providers (data processors) who are working on our behalf or providing services to us. We obtainappropriate contractual protections to limit these service providers’ use and disclosure of any information about
you that we share with them.
Infrastructure Processors. We use certain third parties for some of the infrastructure used to host data that is
submitted to the Smartsheet platform, including cloud providers.
Service Processors. We use third party service providers to process your personal data to assist us in business andtechnical operations. Smartsheet has data processing agreements with such service providers, and their use of andaccess to personal data is limited to specific purposes. They provide services relating to: billing, customer support,internet and connectivity, marketing (direct mail, email, lead generation), security, user experience.
Subcontractors: Independent Contractors. We may employ the assistance of independent contractors to work on
specific projects. We train these independent contractors on applicable Smartsheet policies and they are required
to adhere to substantially the same data security practices as are Smartsheet employees.
As Required by Law. We release information about you if we believe we must do so to comply with the law or a
subpoena, bankruptcy proceeding, or similar legal process.
To Protect Rights. We may disclose information about you, such as your name, contact information, and billinginformation, to enforce our agreements with you or to protect the rights and safety of Smartsheet, our customers,
our users, and the general public, or as evidence in litigation in which we are involved.
In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets,
your information may be transferred to the acquiring entity as part of the transaction, and may also be reviewed
as part of the due diligence review for the transaction. For example, we may need to provide a list of all customer
accounts and payment histories.
Aggregate and Anonymized Information. We may share aggregate or anonymized information about users withthird parties for marketing, advertising, research, or similar purposes. For example, if we display advertisements onbehalf of a third party, we may share aggregate demographic information with that third party about the users towhom we displayed the advertisements.
6. Use of Cookies, Tracking Technologies, Analytics and Behavioral Marketing
In order to make our platform as user-friendly as possible, we – like many other companies – use “cookies”.

Cookies. A cookie is a small text file that is stored in your web browser that allows Smartsheet or a third party torecognize you. Cookies can either be session cookies or persistent cookies. A session cookie expires automaticallywhen you close your browser. A persistent cookie will remain until it expires or you delete your cookies. Expiration
dates are set in the cookies themselves; some may expire after a few minutes while others may expire after
multiple years. Cookies placed by the website you’re visiting are sometimes called “first party cookies,” while
cookies placed by other companies are sometimes called “third party cookies.”
Types of Cookies.
Essential Cookies. These are first party cookies that are sometimes called “strictly necessary” as without them wecannot provide much of the functionality that you need on the Services. For example, essential cookies help
remember your preferences as you move around the Services.
Analytics Cookies. These cookies track information about how the Services are being used so that we can make
improvements and report our performance. They collect information about how visitors use the Services, whichsite the user came from, the number of each user’s visits, and how long a user stays on the Services. We might also
use analytics cookies to test new pages or features to see how users react to them. Analytics cookies may either befirst party cookies or third party cookies.
Preference Cookies. These cookies are also sometimes called “functionality cookies.” During your visit to theServices, cookies are used to remember information you have entered or choices you make (such as yourusername, language, or region) on the Services. They also store your preferences when using the Services, forexample, your preferred language. These preferences are remembered, through the use of persistent cookies, andthe next time you visit the Services you will not have to set them again.
Targeting or Advertising Cookies. These third party cookies are placed by third party advertising platforms or
networks in order to deliver ads, track ad performance, and enable advertising networks to deliver ads that may be
relevant to you based upon your activities (this is sometimes called “behavioral” “tracking” or “targeted”
advertising). More information about how cookies are used for advertising purposes is explained below in
Behavioral Targeting and Remarketing.
Smartsheet’s Use of Cookies. We may use cookies to uniquely identify you, to help us process your transactions
and requests, to track aggregate and statistical information about user activity, and to display advertising on thirdparty sites. Generally, we use these technologies to manage content, analyze trends, monitor page visits andcontent downloads, administer the Sites, track users’ movements around the Sites, and to gather statistics about
our user base as a whole. These technologies may provide us with personal data, information about devices andnetworks you utilize to access our Services, and other information regarding your interactions with our Services.
For detailed information about the cookies in the Services, please read and review our Cookie Chart found here.
How to Disable Cookies. The “help” portion of the toolbar on most browsers will tell you how to prevent yourcomputer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or
how to disable cookies altogether. If you disable cookies, be aware that some features of our Services may not
function.
To learn more about how to control cookie settings through your browser:●

Click here to learn more about the “Private Browsing” setting and managing cookie settings in Firefox.

●

Click here to learn more about “Incognito” and managing cookie settings in Chrome.

●

Click here to learn more about “InPrivate” and managing cookie settings in Internet Explorer.

●

Click here to learn more about “Private Browsing” and managing cookie settings in Safari.

Clear GIFs. Clear GIFs (a.k.a. web beacons or pixel tags) are tiny graphics with a unique identifier, similar in function
to cookies. In contrast to cookies, clear GIFs are embedded invisibly on web pages, and are not stored on your hard
drive. We might use clear GIFs to track the activities of Site visitors and users of our Services, to help us manage
content, and to compile statistics about usage. We and our third party service providers also might use clear GIFs
in HTML e-mails to our customers to help us track e-mail response rates, identify when our e-mails are viewed, andtrack whether our e-mails are forwarded.
Third-Party Analytics. We also use automated devices and applications, such as Google Analytics (more info here)
and Optimizely (more info here) to evaluate use of our Services. We use these tools to gather non-personal data
about users to help us improve our Services and user experiences. These analytics providers may use cookies andother technologies to perform their services, and may combine the information they collect about you on our Sites
with other information they have collected for their own purposes. This Policy does not cover such uses of data by
third parties.
Behavioral Targeting and Remarketing. We use advertising platforms, including but not limited to Google
Ads/DoubleClick (more info here), Facebook Custom Audience (more info here), LinkedIn Marketing (more infohere), Microsoft/Bing (more info here) and Marketo (more info here), to display ads as part of our advertising
campaigns. As a result, our ads may be displayed to you on a search results page or on third party sites. Our
advertising partners use cookies and other technologies to collect information about your activities on our Services
and other sites to provide you targeted advertising based upon your interests. These third parties may collect yourIP address or other device identifiers and combine the information they collect on our Sites with information about
your visits to other sites to create market segments that they will use to more effectively advertise our services
and those of other advertisers.
Custom Audiences. We may share your email address or other information with our advertising partners to assist
us in reaching you with more relevant ads outside of the Sites; they are not permitted to use this information for
their own or third party marketing purposes. If you’d like to opt out of this, please email
privacy@smartsheet.com.
Opting Out of Ad Networks. If you wish to not have this cross-site information used for the purpose of serving you
targeted ads, you may opt-out of many ad networks by clicking here (or if located in the European Union, clickhere). You will continue to receive ads on the sites you visit, but the ad networks from which you have opted out
will no longer target ads to you based upon your activities on other sites. Please note, however, that these opt-out
mechanisms are cookie based; so, if you delete cookies, block cookies or use another device, your opt-out will nolonger be effective. For more information, go to www.aboutads.info.
Do Not Track. Some browsers have incorporated "Do Not Track" (DNT) features that can send a signal to thewebsites you visit indicating you do not wish to be tracked. Currently, our systems do not recognize browser “donot-track” requests. In the meantime, you can use the “help” portion of the toolbar on most browsers to learn
how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive
a new cookie, or how to disable cookies altogether. If you disable cookies, be aware that some features of our Sites
may not function.
7. Your Choices and Rights
Closing Your Account. If you wish to close your account, you may do so by logging in and using the Account
Administration settings or by contacting us at https://www.smartsheet.com/gethelp. If you shared any Content or
information through our Services with other users, such Content or information will continue to be accessible tosuch users.
Content. Requests to access, delete, or modify Content will be directed to the Customer who owns the account. If
you wish to request access to personal data contained in Content to delete, modify, or limit use, please provide us

with the name of the Customer who submitted your information to our Services. We will refer your request to that
Customer and will support them as needed.
Access and Correction. If you are not on an enterprise account, you may log in and use the Account Administration
settings or contact us at https://www.smartsheet.com/gethelp to access or update account profile information. If
you are on an Enterprise account, you may login log in and use the Account Administration settings or contact anadministrator for the account to access or update account profile information. Smartsheet will support its
enterprise customers as needed to update your account information.
Marketing Choices. Customers can always opt out of being contacted by us for marketing or promotional purposesby following the opt-out instructions located in the e-mails we send, by changing the account privacy settings, orby emailing us at privacy@smartsheet.com. Please note that if you opt out of marketing communications,
Smartsheet will continue to send you transactional or service-related communications, such as service
announcements and administrative messages. If you do not wish to receive these, you have the option to cancel
your account by logging in and using the Account Administration settings or by emailing us athttps://www.smartsheet.com/gethelp.
Users in the European Economic Area.
Individuals in the EEA have the following rights with respect to their personal data:•

Access. You can ask us to confirm whether we are processing your personal data; give you a copy of that
data; and provide you with other information about your personal data such as what data we have, what
we use it for, who we disclose it to, whether we transfer it abroad, how we protect it, how long we keep it
for, what rights you have, how you can make a complaint, where we got your data from and whether wehave carried out any profiling, to the extent that such information has not already been provided to you inthis Policy.

•

Rectification. You can ask us to rectify inaccurate information. We may seek to verify the accuracy of thedata before rectifying it.

•

Erasure. You can ask us to erase your personal data, but only where it is no longer needed for the
purposes for which it was collected; you have withdrawn your consent (where the data processing was
based on consent); following a successful right to object (see 'Objection' below); it has been processedunlawfully; or to comply with a legal obligation to which we are subject. We are not required to comply
with your request to erase your personal data if the processing of your personal data is necessary forcompliance with a legal obligation or for the establishment, exercise, or defense of legal claims. There arecertain other circumstances in which we are not required to comply with your erasure request, althoughthese two are the most likely circumstances in which we would deny that request.

•

Restriction. You can ask us to restrict (i.e., keep but not use) your personal data, but only where its
accuracy is contested (see 'Rectification' above), to allow us to verify its accuracy; the processing is
unlawful, but you do not want it erased; it is no longer needed for the purposes for which it was collected,
but we still need it to establish, exercise, or defend legal claims; you have exercised the right to object,and verification of overriding grounds is pending. We can continue to use your personal data following arequest for restriction where we have your consent; to establish, exercise, or defend legal claims; or toprotect the rights of another natural or legal person.

•

Objection. You can object to any processing of your personal data which has our 'legitimate interests' as
its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests.
Once you have objected, we have an opportunity to demonstrate that we have compelling legitimate
interests which override your rights and freedoms. In addition, you can object to the processing of yourpersonal data for direct marketing purposes, which includes profiling to the extent that it is related tosuch direct marketing without providing any reason. We will then cease the processing of your personal
data for direct marketing purposes.
•

Portability. You can ask us to provide your personal data to you in a structured, commonly used,machine-readable format, or you can ask to have it 'ported' directly to another Data Controller, but only
where our processing is based on your consent and the processing is carried out by automated means.

•

Withdrawal of Consent. You can withdraw your consent in respect of any processing of personal data
which is based upon a consent which you have previously provided.

8. Data Retention
We keep your personal data for as long reasonable necessary for the purposes set out in Section 4 above. Except
as noted below, we will retain your account profile data as necessary for our legitimate business purposes or tocomply with our legal obligations (such as record keeping, accounting, fraud prevention and other businessadministrative purposes); generally, where we no longer have a legitimate business purpose to retain it, we will
anonymize or delete such personal data within 180 days after the closing of your account. However, we will
maintain your personal information longer where required for tax or accounting purposes, to ensure we would be
able to defend or raise a claim, or where we have a specific need to retain, though we will generally not keep
personal data for longer than seven years following the last date of communication with you. Legitimate businesspurposes that we may rely on to keep your personal data when you are not a customer include direct marketing(where you have not opted-out) for up to two years, facilitating the restoration or establishment of a user accountin the future, maintaining Smartsheet’s business intelligence systems for analytics and other internal purposes, etc.
Where your information is no longer required, we will ensure it is disposed of in a secure manner.
9. How We Protect Your Information
We have implemented technical, physical, and administrative safeguards to protect your information. However, no
company, including Smartsheet, can guarantee the absolute security of Internet communications. If you have any
questions about how we secure your information, please refer to our Security page, or contact us athttps://www.smartsheet.com/gethelp .
10. Blogs; Forums
Our Sites may contain publicly accessible blogs and community forums (including the Community Features). Be
aware that any information you provide in these areas may be read, collected, and used by others who accessthem. To request removal of your information from our blog or community forum, contact us athttps://www.smartsheet.com/gethelp. In some cases, we may not be able to remove your information; if that
happens, we will let you know why.
11. Linked Sites; Third Party Widgets
Links to Other Websites. Our Services include links to other websites with privacy practices that may differ fromours. Any information you submit to a website not belonging to Smartsheet is governed by that site’s privacy
statements, not this one. We encourage you to carefully read the privacy statement of any website you visit.
Plugins and Social Media Widgets. Our Sites may include social media features and widgets (collectively“Widgets”), such as a "share this" button or other interactive mini-programs that run on our Services. Widgets canbe used to provide you specific services from other companies (e.g., displaying the news, opinions, music, etc.).
Personal data, such as your email address, may be collected through the Widgets. Cookies may also be set by the
Widgets to enable them to function properly. Widgets displayed on our Sites are not hosted by Smartsheet and are
subject to the privacy policies of the third party company providing the Widget, and not this Policy.
12. Children’s Personal Data

The Services are not directed toward children and we do not encourage children to participate in providing us withany personally identifiable information. We do not knowingly collect any personal data from children under theage of 13. We encourage parents and legal guardians to monitor their children’s Internet usage and to help
enforce this Policy by instructing their children never to provide personal data through the Services. If you havereason to believe that a child under the age of 13, without a parent or guardian's consent has provided personal
data to us through the Services, please contact us at privacy@smartsheet.com, and we will use commerciallyreasonable efforts to delete that information.
13. International Transfers and Smartsheet Privacy Shield NoticeInternational Transfer of Data. We are based in the United States and the information we collect is governed by
U.S. law. The information we collect may be transferred to, used from, and stored in the United States or otherjurisdictions in which Smartsheet, our affiliates, or service providers are located; these jurisdictions (including theUnited States) may not guarantee the same level of protection of personal data as the jurisdictions in which you
reside. By using the Services, you acknowledge and agree to any such transfer of information outside of thejurisdiction in which you reside.
U.S.-EU Privacy Shield and U.S-Swiss Privacy Shield Certifications. Smartsheet participates in and has certified its
compliance with the EU-U.S. and US-Swiss Privacy Shield Frameworks and Principles (collectively, the “Privacy
Shield Principles”). Smartsheet will comply with the Privacy Shield Principles with respect to the personal data we
receive in the United States from the European Economic Area and Switzerland. You can review the Privacy ShieldPrinciples, learn more about Privacy Shield, and view our Privacy Shield certification athttps://www.privacyshield.gov/. Smartsheet’s commitments under the Privacy Shield are subject to theinvestigatory and enforcement powers of the United States Federal Trade Commission.
Law Enforcement Requests. In certain situations, we may be required to disclose personal data in response tolawful requests by public authorities, including to meet national security or law enforcement requirements.
Onward Transfers. Third parties who process personal data on our behalf must agree to use such personal data
only for the purpose for which it is provided by us and they must contractually agree to provide adequate
protections for personal data. Smartsheet will continue to be liable for any onward transfers of personal data tosuch third parties. Where required by applicable data protection laws, we have ensured that such third parties sign
standard contractual clauses as approved by the European Commission or other supervisory authority. You canobtain a copy of such safeguards by contacting us (see below).
Complaints or Questions About Our Privacy Shield Certifications. If you have any questions or complaints regarding
our Privacy Shield Certification, you may contact us at privacy@smartsheet.com. We will promptly investigate andattempt to resolve any complaints, and will respond to your complaint within 45 days of receiving any suchcomplaint. If you are a user located in the EEA whose complaint cannot be resolved through this process, we will
participate in the dispute resolution process administered by JAMS. For information about how to initiate a Privacy
Shield claim with JAMS, please contact JAMS at https://www.jamsadr.com/file-an-eu-us-privacy-shield-or-safeharbor-claim. Under certain conditions (which are described on the Privacy Shield website), you may invoke
binding arbitration when other dispute resolution procedures have been exhausted.
14. Changes to this Policy
We may update this Policy to reflect changes to our privacy practices. If you are a Smartsheet customer and we
make any material changes that affect the way we treat information that we have previously collected from you,we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice throughthe Services prior to the change becoming effective. We encourage you to periodically review this Policy for thelatest information on our privacy practices.
15. How to Contact Us/Dispute Resolution

If you have any questions or concerns regarding the way in which your personal data is being processed or you
want to exercise your rights above, please reach out to Smartsheet using the contact information below:-

Smartsheet’s Vice President of Legal, who serves as Company’s data protection contact, and can becontacted at privacy@smartsheet.com.

-

EU Representative. You may also contact our EU Representative as follows:
Smartsheet UK Ltd.
Argyle House, 3 Lady Lawson St.
Edinburgh
EH3 9DR
Email: privacy@smartsheet.com

If you remain dissatisfied, you have the right to reach out directly to the Data Protection Authority in yourjurisdiction. We do ask that you please attempt to resolve any issues with us first, although you have a right tocontact the Data Protection Authority at any time.
If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our
U.S.-based third party dispute resolution provider (free of charge) at https://www.jamsadr.com/file-an-eu-usprivacy-shield-or-safe-harbor-claim.
16. English Version Controls
Non-English translations of this Policy are provided for convenience only. In the event of any ambiguity or conflict
between translations, the English version is authoritative and controls.