Smartsheet Privacy Notice
Last Updated: October 2019
At Smartsheet, we understand that you need to know how data about you (i.e., personal data) is used. The
Smartsheet Privacy Notice is comprised of this page and the notices below which describe how we collect, use, andshare personal data and explain your related rights and choices. ‘We’ are Smartsheet Inc. ‘You’ may be a visitor toone of our websites including www.smartsheet.com (‘Sites’) or a user of our internet-delivered work collaboration
services and applications, including our mobile applications, or any of our services available through the Sites(‘Services’).
_____________________________________________________________________________________________
Specific Notices
Who We Are
Your Choices
Your Rights
Personal Data Retention
How We Protect Personal Data
ChildrenInternational Transfers and Privacy Shield Notice
Changes to this Notice
How to Contact Us
English Version Controls____________________________________________________________________________________________
Specific Notices
Together with the information on this page, the following notices describe our use of your personal data based on
how we interact with you:
General Privacy Notice. When we interact with you outside the Services (e.g., on our Sites, during events, or
through surveys).
Services Privacy Notice. When you sign up for or use Services which we provide to you or, if you are anorganizational user, to our customer with whom you have a relationship (e.g., employer/employee).
Cookie Notice. When data is collected automatically from your device by way of cookies and other tracking
technologies.

Applicant Notice. When you apply for a job with Smartsheet.

Who We Are
Smartsheet Inc. is headquartered in the United States, with offices in Washington and Massachusetts. You canlearn about us and our Services here.
Smartsheet Inc. may share personal data with our affiliated companies for our or our affiliate’s internal businesspurposes (e.g., when you purchase an affiliate’s services from Smartsheet). The following privacy notices are
tailored for the different ways your personal data may be collected, used, shared and processed by different
Smartsheet lines of business:-

Artefact Product Group LLC dba 10,000 Ft-

TernPro, Inc. d/b/a Slope-

Smartsheet UK Ltd. formerly known as Helpa Ltd. and Converse.aiYour Choices
Marketing Communications. You can opt out of being contacted by us for marketing or promotional purposes byfollowing the instructions in marketing emails we send or by unsubscribing here.
Custom Audiences. If you’d prefer we do not include you in custom audiences, submit this form.
Cookies. Please visit our Cookie Notice to learn about and exercise your choices relating to cookies.
Your Rights
You may have certain rights relating to your personal data under local data protection laws or based on your use of
our Services. For example:
European Economic Area
Erasure. You can ask us to erase your personal data if certain conditions are met. We are not required to comply
with your request to erase your personal data if the processing of your personal data is necessary for compliancewith a legal obligation or for the establishment, exercise, or defense of legal claims.
Objection. You can object to any processing of your personal data which is done on the basis of our 'legitimate
interests', if you believe your fundamental rights and freedoms outweigh our legitimate interests. Once you have
objected, we have an opportunity to demonstrate that we have compelling legitimate interests which override
your rights and freedoms. In addition, you can object to the processing of your personal data for direct marketingpurposes, which includes profiling to the extent that it is related to such direct marketing. We will then cease theprocessing of your personal data for direct marketing purposes.
Portability. You can ask us to provide your personal data to you in a structured, commonly used, machine-readable
format, or you can ask to have it 'ported' directly to another data controller, but only where our processing isbased on your consent and the processing is carried out by automated means.
Rectification. You can ask us to correct information; we may verify the accuracy of the data before rectifying it.
Restriction. You can ask us to restrict (i.e., keep but not use) your personal data, but only where: its accuracy iscontested (see 'Rectification' above), to allow us to verify its accuracy; the processing is unlawful, but you do notwant it erased; it is no longer needed for the purposes for which it was collected, but we still need it to establish,
exercise, or defend legal claims; you have exercised the right to object, and verification of any overriding grounds
is pending. We can continue to use your personal data following a request for restriction where we have yourconsent; to establish, exercise, or defend legal claims; or to protect the rights of another.
Withdrawal of Consent. You can withdraw your consent where processing is based on a consent you havepreviously provided. If you have questions about how to withdraw a consent you had provided, please complete
this form.
Exercise of Rights. To exercise your rights please contact us using this form or using the contact details provided
under the "How to Contact Us/Dispute Resolution" heading. We do not discriminate based on whether you choose
to exercise your choices and rights and will not, based on your exercise of rights, deny the Services to you; charge
you different rates (including through penalties or discounts/benefits); provide a different level or quality ofServices; or suggest you may receive such different treatment.
California
Access. You can ask us to confirm we’re processing your personal data, provide you with details about suchprocessing, and give you a copy of your personal data.
Erasure. You can ask us to erase your personal data if certain conditions are met. We are not required to comply
with your request to erase your personal data if the processing of your personal data is necessary for compliancewith a legal obligation or for the establishment, exercise, or defense of legal claims.
Portability. You can ask us to provide your personal data to you in a structured, commonly used, machine-readable
format, or you can ask to have it 'ported' directly to another data controller, but only where our processing isbased on your consent and the processing is carried out by automated means.

Exercise of Rights. To exercise your rights please contact us using this form or using the contact details provided
under the "How to Contact Us/Dispute Resolution" heading. We do not discriminate based on whether you choose
to exercise your choices and rights and will not, based on your exercise of rights, deny the Services to you; charge
you different rates (including through penalties or discounts/benefits); provide a different level or quality ofServices; or suggest you may receive such different treatment.
Mobile users
Access. You can ask us to confirm we’re processing your personal data, provide you with details about suchprocessing, and give you a copy of your personal data.
Erasure. You can ask us to erase your personal data if certain conditions are met. We are not required to comply
with your request to erase your personal data if the processing of your personal data is necessary for compliancewith a legal obligation or for the establishment, exercise, or defense of legal claims.
Withdrawal of Consent. You can withdraw your consent where processing is based on a consent you havepreviously provided. If you have questions about how to withdraw a consent you had provided, please complete
this form.
Exercise of Rights. To exercise your rights please contact us using this form or using the contact details provided
under the "How to Contact Us/Dispute Resolution" heading. We do not discriminate based on whether you choose
to exercise your choices and rights and will not, based on your exercise of rights, deny the Services to you; charge
you different rates (including through penalties or discounts/benefits); provide a different level or quality ofServices; or suggest you may receive such different treatment.
---------------------------------------------------------------------------------------------------------------------------------------------------Data Retention
We keep your personal data for as long as reasonably necessary for the purposes set out in our notices (see ‘How
We Use Personal Data’ in the applicable notice). We’ll keep your personal data longer if required for tax oraccounting purposes, to ensure we would be able to defend or raise a claim, or where we have a specific need though we will generally not keep personal data for longer than seven years following the last date ofcommunication with you. Where personal data is no longer required, we anonymize or dispose of it in a securemanner.
How We Protect Your Information
We have implemented technical, physical, and administrative safeguards to protect your personal data. However,no company, including Smartsheet, can guarantee the absolute security of Internet communications.

Children’s Personal Data
Our Sites are not directed toward children under 18 and we don’t knowingly collect personal data from minors. If
you are under 18, please do not use the Sites or Services or share personal data with us. If you learn that anyone
younger than 18 has unlawfully provided us personal data, please contact us.
International Transfers and Privacy Shield Notice
Personal data we collect may be transferred to, used, and stored in the United States or other jurisdictions inwhich Smartsheet, our affiliates, or service providers are located; these locations (including the United States) may
not guarantee the same level of protection of personal data as the one in which you live. Smartsheet assesses thecircumstances involving all cross-border data transfers and has suitable safeguards in place to require that yourpersonal data will remain protected in accordance with this notice.
Smartsheet participates in the EU-U.S. and U.S.-Swiss Privacy Shield Frameworks and Principles (collectively, the“Privacy Shield Principles”). We will comply with the Privacy Shield Principles with respect to personal datatransferred to the United States from the European Economic Area (‘EEA’), the United Kingdom, and Switzerland.
You can review the Privacy Shield Principles, learn more about Privacy Shield, and view our Privacy Shieldcertification at https://www.privacyshield.gov/. Smartsheet’s commitments under the Privacy Shield Principles are
subject to the investigatory and enforcement powers of the United States Federal Trade Commission. In certain
situations, we may be required to disclose personal data in response to lawful requests by public authorities,
including to meet national security or law enforcement requirements. Smartsheet is and will remain liable for theprocessing of personal data it receives under each Privacy Shield Framework and subsequently transfers to a third
party acting as an agent on its behalf (see ‘How We Share Personal Data’ in the applicable notice). We comply with
the Privacy Shield Principles for all onward transfers of personal information from the EEA, including the onward
transfer liability provisions. If there is a conflict between the terms of this notice and the Privacy Shield Principles,
the Privacy Shield Principles will govern.
In addition, Smartsheet has implemented the European Commission’s Standard Contractual Clauses for transfersof personal data between our affiliated companies, which require all of our affiliates to protect personal data they
process from the EEA in accordance with European Union data protection law. We have implemented similar
appropriate safeguards where legally required with our third party service providers and partners; details can beprovided upon request.
Changes to this Notice
We may update this notice to reflect changes to our privacy practices, changing technologies, industry practices,
regulatory requirements, or for other reasons. If we make any material changes that affect the way we treat yourdata, we will notify you by email, through the Sites, or by other legally acceptable means. We encourage you toperiodically review this notice for the latest information on our privacy practices.
How to Contact Us/Dispute Resolution
You have the right to complain to a data protection authority about our collection and use of your personal data,
but we encourage you to reach out to us first. The best way to reach us is by filling out this form. Smartsheet’s
Privacy Counsel serves as Smartsheet’s data protection contact and can be reached at:
Webform: Contact Privacy Form
Email: privacy@smartsheet.com
Address: Attn: Legal - Privacy Office, 10500 NE 8th Street, Suite 1300, Bellevue WA 98004

Residents of the EEA. The controller of your personal data is Smartsheet Inc. Where processing is undertaken by
our affiliated companies, they are joint controllers with Smartsheet Inc. for your personal data. You may contact
our EU Representative, Smartsheet UK Ltd, at:
Webform: Contact Privacy Form
Email: privacy@smartsheet.com
Address: Attn: Smartsheet Legal, Clarendon House, 116 George St, Edinburgh EH2 4LH

Complaints or Questions About Our Privacy Shield Certifications. If you have any questions or complaints regarding
our Privacy Shield Certification, please complete this form or email privacy@smartsheet.com. We will respondwithin 45 days of receiving your complaint and will promptly investigate and attempt to resolve it. If you reside in
the EEA and your complaint cannot be resolved through this process, we will participate in the dispute resolution
process administered by JAMS. For information about how to initiate a Privacy Shield claim with JAMS, pleasecontact JAMS directly. Under certain conditions (described on the Privacy Shield website), you may invoke binding
arbitration when other dispute resolution procedures have been exhausted.
English Version Controls
Unless prohibited by local laws, non-English translations of this notice are provided for convenience only and in theevent of any ambiguity or conflict between translations, the English version is authoritative and controls.

Smartsheet General Privacy NoticeThis notice applies where we process personal data through our Sites, during events, or in any other interactions
with you outside of your use of the Services.
Personal Data We Collect
How We Use Personal Data
How We Share Personal Data
Blogs; Forums
Linked Sites; Third Party Widgets
Who We Are
Your Choices
Your Rights
Personal Data Retention
How We Protect Personal Data
ChildrenInternational Transfers and Privacy Shield Notice
Changes to this Notice
How to Contact Us
English Version Controls

Personal Data We Collect
We may collect personal data directly from you, from third parties, or automatically when you use the Sites. We
collect this personal data for the purposes outlined below in ‘How We Use Personal Data’. See this table forcategories of personal data we collect.
How We Use Personal DataWe will only use your personal data if we have a lawful basis to do so, as illustrated by this table. Specifically, we
use your personal data at your instruction or as follows:
Providing and Personalizing our Sites. To operate and administer the Sites and to provide you with the content you
choose to access or request; to tailor web content we display to you in order to offer location customization (e.g.,setting a default language) and to otherwise personalize your experience using the Sites. We use cookies andsimilar tracking technologies to automatically collect your personal data for this purpose (see our Cookie Notice).
Personalizing Events. To tailor event invitations we send or display to you in order to offer location customization(e.g., local event offerings). We use cookies and similar tracking technologies to automatically collect your personal
data for this purpose (see our Cookie Notice).
Identifying Customer Opportunities. To identify and assess potential new users through tools like LinkedIn Sales
Navigator, and to engage with individuals responding to web content produced by Smartsheet.
Sending Marketing Communications. For direct marketing, promotional, and other non-transactional
communications (e.g., newsletters, calls, SMS, or push notifications) in order to share information about special
offers, promotions, and events or to otherwise contact you about Smartsheet products or information we think
may interest you, in accordance with your marketing preferences.
Displaying, Measuring Personalized Advertisements. To provide more relevant advertising to you on the Sites or
third party platforms; to conduct related marketing research (e.g., by measuring the success of targeted
advertising campaigns). We use cookies and similar tracking technologies to automatically collect your personal
data for this purpose (see our Cookie Notice).
Managing Event Registrations and Contests. To plan and host events or webinars you’ve registered for or attend,
including sending related communications to you; and to provide contests, promotions, and sweepstakes you’vechosen to participate in or register for (contests may have additional rules relating to how we process yourpersonal data).
Analytics and Improvement. To better understand how you access and use the Sites and Services; and for otherresearch and analytical purposes, such as to evaluate and improve the Sites and to develop additional services,
content, and features (e.g., if you choose to participate in a survey or user-interface study, we may use your email
address to reach out with follow-up questions or additional studies).
Protect Legal Rights and Prevent Misuse. To protect the Sites, Services, and the rights of users and otherindividuals; to prevent unauthorized access and other misuse; and where we believe necessary to investigate,
prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to thesafety of any person, or violations of our terms of use or this notice. We may use machine or deep learningtechnologies for these purposes (e.g., for fraud prevention or detection).
Comply with Legal Obligations. To comply with the law or legal proceedings (e.g., we may disclose data in response
to lawful requests by public authorities, including responding to national security or law enforcement requests).
General Business Operations. Where necessary to the administration of our general business, accounting,recordkeeping, and legal functions.
How We Share Personal Data
We will not sell your personal data to a third party or allow a third party to use personal data we provide for its
own marketing purposes. We may share information about you with your consent, at your request, or as follows:
To Our Service Providers. We use third party service providers to process your personal data to assist us in businessand technical operations. Smartsheet has data processing agreements with such service providers limiting theiruse of and access to personal data to specific purposes. They provide services relating, but not limited to fraud
detection and prevention, billing, customer support, internet and connectivity, marketing (direct mail, email, leadgeneration), event organizing, security, user experience.
To Infrastructure Processors. We use third parties for some of the infrastructure used to host content and personal
data we process, including cloud providers. Smartsheet has data processing agreements with such service
providers and their use of and access to personal data is limited to specific purposes.
To Affiliates. We may share your personal data with our affiliates for marketing or lead generation andqualification purposes.
As Custom Audiences. We may share a hashed (scrambled) version of your email address, name, city, state, orsimilar information with advertising partners to assist us in reaching you with more relevant advertisements
outside of the Sites (and to measure the success of such campaigns); these partners are not permitted to retain,use, or disclose this information for their own third-party marketing purposes. If you’d like to opt out of custom
audiences, complete this form.
As Required by Law. We release information about you if we believe we must do so to comply with the law or a
subpoena, bankruptcy proceeding, or similar legal process. In certain situations, we may be required to disclose
personal data in response to lawful requests by public authorities, including to meet national security or law
enforcement requirements.

To Protect Rights. We may disclose information about you, such as your name, contact information, and billinginformation, to enforce our agreements with you or to protect the rights and safety of Smartsheet, our customers,
our users, and the general public, or as evidence in litigation in which we are involved.
As Aggregate and Anonymized Information. We may share aggregate or anonymized information about you with
our third party service providers for our internal business purposes which may include marketing, advertising,research, or similar purposes.
In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets,
your information may be transferred to the acquiring entity as part of the transaction (provided that we inform thebuyer it must use your personal data only for the purposes disclosed in this notice), and may also be reviewed aspart of the due diligence review for the transaction (e.g.,we may need to provide a list of all customer accounts
and payment histories).
Blogs; Forums; Testimonials
Our Sites may contain publicly accessible blogs and interactive features (e.g., the community website). Any
information you provide in these areas may be read, collected, and used by others who access them. To request
removal of your information from our blog or community forum, please complete this form. With your consent, we
may publish testimonials you share with us, which could contain personal data such as your full name and otherinformation you choose to share. If you wish to update or remove your testimonial, please complete this form.
Linked Sites; Third Party Widgets
Links to Other Websites. Our Sites may include links to other websites with privacy practices that may differ fromours. Any information you submit to a website not belonging to Smartsheet is governed by that site’s privacy
statement, not this one.
Plugins and Social Media Widgets. Our Sites may include social media features and widgets (‘widgets’), such as a‘share this’ button or other interactive mini-programs. Widgets can be used to provide you specific services fromother companies (e.g., displaying the news, opinions, music, etc.). Personal data such as your email address may becollected through widgets. Cookies may also be set by widgets to enable them to function properly. Widgets
displayed on our Sites are not hosted by Smartsheet and are subject to the privacy policies of the third party
company providing the widget, and not this notice.

General Privacy Notice
Categories of Personal Data Collected

Purposes ofProcessing
Providing Our
Sites,
Personalization,or
Event
Registration &Contests.

Categories of Personal Data
Processed For Each Purpose
Directly from You:• name, email address,
physical address, phone
number, and other similar
contact information;• professional andorganizational profile
information, such as title,
department, andcompany size/revenue;• payment information(e.g., partial credit card
number and billing
address);• feedback, testimonials,
inquiries, and non-Service
related phone
conversations, chats oremails;• image (still or video),voice, and otheridentifiers when you
attend an event or use
certain features on theSites (e.g., a profile photoin Smartsheet
Community);• location information (e.g.,
from your language
preference on the Sites ora provided address); and• any additional
information you choose toshare on the Sites.
From Third Parties:• event registration
information (e.g., name,email address, company,

Legal Bases ofProcessing(EU Users)*
Necessary toenter into or
perform acontract with
You (upon yourrequest, or asnecessary to
make the Sites
available),
Legitimate
interests**, orHow We Gather Data
From YouWe may collect personal
data directly from you
when you:•••With yourconsent.
••

interact with theSites orcommunityfeatures;search for orindicate interestin the Services;
register for or
attend an event
attended or
hosted by
Smartsheet;communicate
with us byphone, email, orother means;
andfill out a
webform,questionnaire,or otherinformation
request.

We may collect personal
data automaticallywhen you:•••interact with ourSites;
download
content fromour Sites; andcommunicate
with us by email(e.g., opening

•

title, etc.) from event
coordinators or vendors;
andlocation of devices, forexample through IP lookup.

emails oraccessing links
in emails).

Automatically:• email addresses andphone numbers used tocontact us; and• network and connection
information, such as theInternet protocol (IP)address used to connect
your computer or otherdevice to the Internet andinformation about yourInternet service provider.
Marketing &Promotions,Customer
Opportunities,
orAdvertising.

Directly from You:• location information (e.g.,
from your language
preference on the Sites ora provided address);• professionalorganizational profile
information, such as yourtitle, department, andcompany size/revenue;
and• usernames, aliases, andother authentication
information with respect
to optional features(e.g.,Smartsheet
Community).
From Third Parties:• name, email address,
physical address, phone
number, and other similar
contact information; and• business contact
information, including
mailing addresses, job

Legitimate
interests**, orWith yourconsent.

We may collect personal
data directly from you
when you:
•

•

•

•

•

interact with theSites orcommunityfeatures;search for orindicate interestin the Services;
register for or
attend an event
attended or
hosted by
Smartsheet;communicate
with us byphone, email, orother means;
andfill out a
webform,questionnaire,or othertitles, email addresses,
phone numbers, IP
addresses, social media
profiles, LinkedIn URLs
and custom profiles.

information
request.
We may collect personal
data automaticallywhen you:

Automatically:• network and connection
information, such as theInternet protocol (IP)address used to connect
your computer or otherdevice to the Internet andinformation about yourInternet service provider;and• identifiers andinformation contained in
cookies (see our Cookie
Notice).
Analytics &Improvement

Directly from You:• your name, email address,
physical address, phone
number, and other similar
contact information if you
choose to participate in asurvey or user interface
study.
From Third Parties:• location of devices, forexample through IP lookup.
Automatically:• identifiers andinformation contained in
cookies (see our Cookie
Notice);• the full Uniform Resource
Locators (URL) clickstream
event data on our Sites,
including referrer data,
click event data (including
date and time), content•••

Legitimate
interests**, orWith yourconsent.

interact with ourSites;
download
content fromour Sites; andcommunicate
with us by email(e.g., opening
emails oraccessing links
in emails).

We may collect personal
data directly from you
when you:
•

•

•

•

•

interact with theSites orcommunityfeatures;search for orindicate interestin the Services;
register for or
attend an event
attended or
hosted by
Smartsheet;communicate
with us byphone, email, orother means;
andfill out a
webform,questionnaire,or other•Protect
Rights/Prevent
Misuse,Comply with
Legal
Obligation, orGeneralBusiness
Operations.

you viewed or search
queries on our Sites,
performance data (e.g.,
page response times),
downloads, HTTP
response codes, and pageinteraction information(e.g., clicks); andnetwork and connection
information, such as theInternet protocol (IP)address used to connect
your computer or otherdevice to the Internet andinformation about yourInternet service provider.

Directly From You:• name, email address,
physical address, phone
number, and other similar
contact information.
Automatically:• network and connection
information, such as theInternet protocol (IP)address used to connect
your computer or otherdevice to the Internet andinformation about yourInternet service provider;and• computer and device
information, such asdevice, application, orbrowser type and version,browser plug-in type andversion, operating system,or time zone setting.

information
request.
We may collect personal
data automaticallywhen you:•••Compliancewith a legal
obligation; orLegitimate
interests**.

interact with ourSites;
download
content fromour Sites; andcommunicate
with us by email(e.g., opening
emails oraccessing links
in emails).

We may collect personal
data directly from you
when you:
•

•

•

•

•

interact with theSites orcommunityfeatures;search for orindicate interestin the Services;
register for or
attend an event
attended or
hosted by
Smartsheet;communicate
with us byphone, email, orother 5means;
andfill out a
webform,questionnaire,or otherinformation
request;We may collect personal
data automaticallywhen you:•••interact with ourSites;
download
content fromour Sites; andcommunicate
with us by email(e.g., opening
emails oraccessing links
in emails).

*For the personal data from the EU that we process, this column describes the relevant legal bases
under GDPR and local implementing laws of EU member states for processing personal data fromthe EU; this does not limit or modify the obligations, rights, and requirements under the privacy lawsof non-EU jurisdictions. Additional information about our legal bases for processing particular
categories of data is available upon request.
** For the personal data from the EU, the processing is in our legitimate interests, which are notoverridden by your interests and fundamental rights.

Smartsheet Services Privacy NoticeThis notice applies with respect to personal data we process when you sign up for or use the Services.
Scope
Personal Data We Collect
How We Use Personal Data
How We Share Personal Data
Integrations; Notifications; Linked Websites
Mobile Application
Choices Relating to Your Use of the Services
Who We Are
Your Choices
Your Rights
Personal Data Retention
How We Protect Personal Data
ChildrenInternational Transfers and Privacy Shield Notice
Changes to this Notice
How to Contact Us
English Version Controls

Scope
Content Out of Scope. Our Services permit customers to share and manage information by uploading andsubmitting ‘content’ that can be shared, stored, and accessed through the Services. This notice does not cover thatcontent, including any personal data contained in it. Customers control the nature of the content and are the data
controllers. We are a data processor of such content, which means we only use it as directed by customers.
Sharing With Other Users of the Services. Some of the features and functionality of the Services involve disclosureof your personal data to other users of the Services; for example, your name, email address, and profile image may
be displayed when a user views collaborators on a “sheet” and users may see the history details on a sheet (e.g.,
your email, access/edits, date and time stamp, etc.). Customers, as data controllers, control the disclosure ofcontent with other users of the Services. We, as a data processor, follow instructions from customers with respect
to how their content is shared with other users of the Services.
Organizational Users. When you use the Services on behalf of an organization (e.g., your employer), your use isadministered and provisioned by your organization in accordance with its own policies regarding the use andprotection of personal data. With respect to personal data contained in content, we are collecting and processing
your personal data on behalf of your organization, who is the data controller. Smartsheet is not responsible for theprivacy or security practices of our customers. We may also share personal data with your organization about youruse of the Services that may include technical details (e.g., metadata) relating to your content or usage of theServices. If you have questions about how your data is being accessed or used by your organization, please refer toyour organization's privacy policy and direct your inquiries to your organization’s system administrator. Please
note that if you lose access to your account (e.g, change of employment), you may lose access to content
associated with that account.
Personal Data We Collect
We collect personal data directly from you, from third parties, and automatically when you use the Services. We
collect this personal data for the purposes outlined below in ‘How We Use Personal Data’. If we cannot collect thisdata, we may be unable to on-board you as a customer or provide the Services to you. See this table for categories
of personal data we collect.
How We Use Personal Data
We will only use your personal data if we have a lawful basis to do so, as illustrated by this table. Specifically, we
use your personal data at your instruction or as follows:
Provision of Services. To provide and operate our Services, fulfill your orders and requests, process your payments,
for bug and error reporting and resolution, to perform upgrades and maintenance, and for similar purposes. This
may include the use of machine or deep learning technologies, as described in the Analytics and Improvement
paragraph below.

Customer Support. To communicate with you about your use of the Services; to respond to your communications,complaints and inquiries; to provide technical support; and for other customer service and support purposes.
Personalization. To tailor content we send or display to you in order to offer location customization (e.g., setting adefault language) and to otherwise personalize your experience using the Services.
Identifying Customer Opportunities. To assess potential customer opportunities as they relate to engaging newusers, meeting the demands of our customers, and enhancing particular users’ experiences (e.g., engaging withcustomer user groups).
Analytics and Improvement. To better understand how our users access and use the Services, and for otherresearch and analytical purposes (e.g., to evaluate and improve the Services and develop additional products,
services, and features). We may use machine or deep learning technologies for these purposes which may allow us
to provide users predictive tips and other features (e.g., suggestions for column types or text).
Protect Legal Rights and Prevent Misuse. To protect the Services and the rights of users and other individuals; toprevent unauthorized access and other misuse; and where we believe necessary to investigate, prevent, or takeaction regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any
person, or violations of our terms of use or this notice. We may use machine or deep learning technologies forthese purposes (e.g., for fraud prevention or detection).
Comply with Legal Obligations. To comply with the law or legal proceedings; for example, we may disclose
information in response to lawful requests by public authorities, including responding to national security or law
enforcement requests.
General Business Operations. Where necessary for the administration of our general business, accounting,recordkeeping, and legal functions.
How We Share Personal Data
We will not sell your personal data to a third party or allow a third party to use personal data we provide for its
own marketing purposes. We may share information about you with your consent, at your request (including when
you use Integrations or Notifications), or as follows:
To Your Organization. If you use Smartsheet on behalf of an organization (e.g., your employer), that organizationmay (i) access information associated with your use of the Services including usage and other data (e.g., who hasaccessed, shared, amended, created, edited, or deleted content), and the contents of the communications andfiles associated with your account; (ii) control and administer your account, including controlling privacy-relatedsettings (e.g., in-app profile settings including choices relating to displaying a profile image); and (iii) access andcontrol content (as noted above, content is outside the scope of this notice).
To Resellers. If you sign up for certain products or services (e.g., free trials) and you are located outside the UnitedStates, we may share your personal data with a Smartsheet reseller so they can contact you about our products,
services, and offers. We will disclose such sharing when you sign up for the applicable product or service, and will,
where required by law, obtain your consent or allow you to opt-out from such sharing. If you purchase Services
through a reseller (regardless of location), we may share certain information about your account and feature usage
with the reseller (or their affiliate) in furtherance of their relationship with you. Resellers are independent data
controllers of your personal data.
Payment Processors. If you use a third party to facilitate your payment obligations, we will share certain accountusage and billing-related information about your account with such third party for billing and businessadministration purposes. Payment processors are independent data controllers of your personal information.
To Our Service Providers. We use third party service providers to process your personal data to assist us in businessand technical operations. Smartsheet has data processing agreements with such service providers limiting theiruse of and access to personal data to specific purposes. They provide services relating to, for example, customer
relationship management, communication, fraud detection and prevention, billing, customer support, internet andconnectivity, marketing, security, training, and user experience.
To Infrastructure Processors. We use third parties for some of the infrastructure used to host personal data weprocess, including cloud providers. Smartsheet has data processing agreements with such service providers limiting
their use of and access to personal data to specific purposes.
To Affiliates. If you purchase one of our affiliate’s services through Smartsheet, we may share your personal datawith the affiliate to provision and service your account.
In Transactions Involving Third Parties. We may make services, software, and content provided by third-parties
available for use on or through the Services; if you engage with a third party provider of such features, you will be
notified or otherwise made aware of personal data being shared related to those transactions with that thirdparty.
As Required by Law. We release information about you if we believe we must do so to comply with the law or a
subpoena, bankruptcy proceeding, or similar legal process.
To Protect Rights. We may disclose information about you, such as your name, contact information, and billinginformation, to enforce our agreements with you or to protect the rights and safety of Smartsheet, our customers,
our users, and the general public, or as evidence in litigation in which we are involved.

As Aggregate and Anonymized Information. We may share aggregate or anonymized information about you with
our third party service providers for our internal business purposes which may include marketing, advertising,research, or similar purposes.
In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets,
your information may be transferred to the acquiring entity as part of the transaction (provided that we inform thebuyer it must use your personal data only for the purposes disclosed in this notice), and may also be reviewed aspart of the due diligence review for the transaction. For example, we may need to provide a list of all customer
accounts and payment histories.
Integrations; Notifications; Linked Websites
Integrations. Our Services may provide access via connectors and integrations (‘integrations’) to your third party
accounts such as Tableau, Slack, or Facebook. Integrations can be used to pull and/or push information from/tothe Services, and to enable the applicable third party to receive notifications, such as sheet updates, from theServices. Any information you authorize to be transferred from the Services to an integration is governed by thethird party’s privacy statement, not this one. We encourage you to carefully read the privacy statement of any
third party you authorize to receive information from the Services.
Sending Notifications. Our Services allow you to send notifications (e.g., update requests) to other individuals
through email, SMS, and other third-party messaging platforms (e.g., Slack, Facebook Messenger, and Microsoft
Teams). Any information you authorize to be transferred from the Services is governed by the third party’s privacy
statement, not this one. We encourage you to carefully read the privacy statement of any third party you authorize
to receive information from the Services.
Links to Other Websites. Our Services include features which allow you to link to other websites with privacy
practices that may differ from ours. Any information you submit to a website not belonging to Smartsheet isgoverned by that site’s privacy statement, not this one.
Mobile Application; Geolocation Data
If you choose to download the Smartsheet mobile application (‘mobile app’), we may receive additional personal
data from your mobile device, in accordance with your preferences. The mobile app may have access to yourdevice’s camera or its geographic location, depending on the features you enable in the Services. Through yourdevice settings, you have the ability to configure what functionality (e.g., your device’s camera or mobile location)
the mobile app can access and we will only access this information at your request. The mobile app may also
gather information related to your use of the mobile app (e.g., device identification, login credentials, language,
and time zone); device event information (e.g., crashes, system activity, and hardware settings); and information

regarding your interaction with the mobile app, which we may use to provide and improve the mobile app. If you
use the services on behalf of an organization, information obtained by the mobile app may be accessible to yourorganization. For additional information about your use of the mobile app, see the Mobile End User License
Agreement.
Choices Related to Your Use of the Services
In addition to “Your Rights” described here, you have the following choices in relation to your use of the Services:
Closing Your Account. If you wish to close your account, you may do so by logging in and using the Account
Administration settings or by submitting this form . If you shared any content or information through our Services
with other users, it will continue to be accessible to those users.
Correcting Your Account. If you are not using the Services on behalf of your organization, you may log in and use
the Account Administration settings or submit this form to access or update your account profile information. If
you are an organizational user, you may login log in and use the Account Administration settings or contact anadministrator on your account to access or update account profile information. If you have questions about how to
withdraw a consent you had provided, please complete this form.

Services Privacy Notice Table
Categories of Personal Data Collected
Purposes ofProcessing

Provision ofServices, orCustomer
Support.

Categories of Personal Data Collected For Each
PurposeLegal Bases ofProcessing(EU Users)*

Directly from You:• your name, email address, physical address,
phone number, and other similar contact
information• professional and organizational profile
information, such as title, department, andcompany size/revenue;• payment information, including partial credit
card number and billing address;• content of feedback, testimonials, inquiries,
support requests, and any phone
conversations, chat sessions and emails
with or to us; and• your image (still or video), voice, and otheridentifiers that are personal to you when you
use certain features on the Services.

Necessary to enter into or
perform a contract with you(upon your request, or asnecessary to make theServices available),

From Third Parties:
•
•

•

•
•

•

your employer may provide your email
address in order to provision your account;subscription, purchase, support, or otherinformation about your interactions withproducts and services offered by us, ouraffiliates, or third parties (e.g., Smartsheet
global resale partners) in relation to theServices;
providers of business contact information,
including mailing addresses, job titles, email
addresses, phone numbers, IP addresses,
social media profiles, LinkedIn URLs andcustom profiles;
payment information, including partial credit
card and billing address from our payment
processors;usernames, aliases, and otherauthentication and security credential
information from third party accounts, forexample if you choose to use single sign-on
services (e.g., Google OpenID, Skype, andMicrosoft Single Sign-On); andsearch results and links, including leadgeneration tools and paid listings.

Automatically:

Establish, defend or protect
legal interests,
Compliance with law, orLegitimate interests**.

•
•
•
•

•
Customer
Opportunities

email addresses and phone numbers used
to contact us;
authentication and security credential
information;
the geo-location of your device or computerwhen using certain features in the Services;
the clickstream through the Services(including date and time), performance data
(e.g., page response times), download
errors, and page interaction information(e.g., clicks); andidentifiers and information contained in
cookies (see our Cookie Notice).

Directly from You:
• content of feedback, testimonials, inquiries,
support requests, and any phone
conversations, chat sessions and emails
with or to us.

Legitimate interests**, orWith your consent.

From Third Parties:• providers of business contact information,
including mailing addresses, job titles, email
addresses, phone numbers, IP addresses,
social media profiles, LinkedIn URLs andcustom profiles.
Automatically:• network and connection information, such as
the Internet protocol (IP) address used toconnect your computer or other device tothe Internet and information about yourInternet service provider.
Personalization

Directly from You:• location information (e.g., from yourlanguage preference on the Sites ora provided address); and• information about your professional profileand your organization, such as your title,
and you organization size and revenue.

From Third Parties:• name, email address, physical address,
phone number, and other similar contact
information; and• business contact information, including
mailing addresses, job titles, email
addresses, phone numbers, IP addresses,
social media profiles, LinkedIn URLs andcustom profiles.

Legitimate interests**, orWith your consent.

Automatically:• identifiers and information contained in
cookies (see our Cookie Notice); and• network and connection information, such as
the Internet protocol (IP) address used toconnect your computer or other device tothe Internet and information about yourInternet service provider.
Analytics &Improvement

Directly from You:
• information provided in support or bug
tickets, such as name, email address,
company.

Legitimate interests**, orWith your consent.

From Third Parties:• location of devices, for example through IP
look-up.
Automatically:• identifiers and information contained in
cookies (see our Cookie Notice);• the clickstream through the Services(including date and time) page response
times, download errors, and page interaction
information (such as scrolling, clicks, andmouse-overs); and• metrics, such as offering usage,occurrences of technical errors, diagnostic
reports, your settings preferences, backup
information, API calls, and other log.s
Protect Rights
and Prevent
Misuse,General Business
Operations, orComply with
Legal Obligation.

Directly from You:• your name, email address, physical address,
phone number, and other similar contact
information.

Compliance with a legal
obligation, orLegitimate interests**.

Automatically:• network and connection information, such as
the Internet protocol (IP) address used toconnect your computer or other device tothe Internet and information about yourInternet service provider; and• computer and device information, such asdevice, application, or browser type andversion, browser plug-in type and version,
operating system, or time zone setting.

* For the personal data from the EU that we process, this column describes the relevant legal bases
under GDPR and local implementing laws of EU member states for processing personal data from theEU; this does not limit or modify the obligations, rights, and requirements under the privacy laws of nonEU jurisdictions. Additional information about our legal bases for processing particular categories of data
is available upon request.

** For the personal data from the EU, the processing is in our legitimate interests, which are notoverridden by your interests and fundamental rights.
With respect to each of the Purposes of Processing in the table above, we may collect personal data
directly from you, your profile, or automatically, when you:- purchase, sign up for, or log into the Services;- configure or modify your personal settings;- interact with or use the Services, including creating or modifying access permissions;- communicate with us by phone, email, or other means to provision or otherwise service or support youraccount; and- fill out a webform, questionnaire, or other information request to provision or otherwise service or
support your account.

Smartsheet Cookie NoticeThis notice explains how we may use cookies, pixels, and similar tracking technologies to gather information about
your use of the Sites and Services - and your rights to control our use of them. This notice supplements
Smartsheet’s Privacy Notice; please visit www.smartsheet.com/legal/privacy for more complete information about
our use of personal data.
What is a Cookie?
What are the Different Types of Cookies Used by Smartsheet?
How Does Smartsheet Use Cookies?
Your Choices
Other Tracking Technologies
Updating this Notice
How to Contact Us?
Cookies Used in Our Services
Cookies Used on the Sites
What is a Cookie?
A cookie is a small text file that is placed on your computer or mobile device when you visit a website. Cookies arewidely used by website owners to make websites work (or work more efficiently) and to provide reporting
information. Cookies can be session cookies or persistent cookies. A session cookie expires automatically when you
close your browser; a persistent cookie will remain on your device until it expires or you delete your cookies.
Persistent cookies can be used to make tasks like logging into services easier for returning users by remembering auser's login information. Expiration dates are set in the cookies themselves; some may expire after a few minutes
while others may expire after a few years. Cookies set by the website owner (in this case, Smartsheet) are called‘first party cookies’. Cookies set by parties other than the website owner are called ‘third party cookies’. Third
party cookies enable third party features or functionality to be provided on or through a website (e.g., advertising,interactive content, and analytics). The company that sets third party cookies can recognize your computer bothwhen it visits the company’s website and when it visits certain other websites. For more information on cookies,
including how to see what cookies have been set on your device and how to manage and delete them, visit
www.allaboutcookies.org.

What are the Different Types of Cookies used by Smartsheet?
Essential Cookies. These are sometimes called ‘necessary,’ as without them we cannot provide many services thatyou need for the Sites and Services to function (e.g., essential cookies help remember your preferences as you
move around the Services). Because these cookies are necessary to deliver the Sites and Services to you, you
cannot refuse them. You can block or delete them by changing your browser settings, as described below under‘Your Choices.’
Performance and Analytics Cookies. These cookies may be set on your device when you visit the Sites to track
information about how the Services and Sites are being used so we can make improvements and report on our
performance. These cookies may collect information such as how visitors use the Sites, the number of visits to theSites or Services, and how long a user stays on the Sites or Services. We might also use performance cookies to test
new pages or notify you about new features to see how users react to them. Statistics cookies on the Sites mayeither be first party cookies or third party cookies.
Functional Cookies. These are also sometimes called ‘preference’ cookies. During your visit to the Sites, cookies areused to enhance the performance of the Sites and to remember information you have entered or choices you havemade (such as your language or region) but are non-essential to your use of the Sites.
Advertising Cookies. These third party cookies are placed by third party advertising platforms or networks on ourSites in order to deliver ads and track ad performance, and to enable advertising networks to deliver ads that may
be relevant to you based upon your activities (sometimes called ‘behavioral,’ ‘tracking,’ or ‘targeted’ advertising).
For more information, see ‘Behavior Targeting and Remarketing.’
How Does Smartsheet Use Cookies?
To make our Services and Sites as user-friendly as possible, we – like many other companies – use cookies touniquely identify you, to help us process your transactions and requests, to track aggregate and statisticalinformation about user activity, and to display advertising on third-party sites. Specifically, on the Sites, we use
these technologies to manage content, analyze trends, monitor page visits and content downloads, administer the
Sites, track users’ movements around the Sites, and to gather statistics about our user base as a whole. In theServices, we only use necessary cookies for authentication and session management. These technologies may
provide us with personal data, information about devices and networks you utilize to access our Sites and Services,and other information regarding your interactions with our SItes and Services. We may combine the information
we receive from cookies with personal data we have otherwise collected. For information about the specificcookies used on the Sites and the Services please see the applicable tables below.

Third-Party Analytics. We also use automated devices and applications, such as Google Analytics (more info here)
and Optimizely (more info here) to evaluate the use of our Sites. We use these tools to gather non-personal
information about users to help us improve our Sites and user experiences. These analytics providers may use
cookies and other technologies to perform their services, and may combine the information they collect about you
on our Sites with other information they have collected for their own purposes. This notice does not cover suchuses of data by third parties.
Behavioral Targeting and Remarketing. We use advertising platforms, including but not limited to Google
Ads/DoubleClick (more info here), Facebook Custom Audience (more info here), LinkedIn Marketing (more infohere), Microsoft/Bing (more info here) and Marketo (more info here), to display ads as part of our advertising
campaigns. As a result, our ads may be displayed to you on a search results page or on third party sites. Our
advertising partners use cookies and other technologies such as web beacons to collect information about youractivities on our Sites and other sites to provide you targeted advertising based upon your interests. The
information collected through this process does not enable us or them to identify your name, contact details orother personally identifying details unless you choose to provide these. However, these third parties may collect
your IP address or other device identifiers and combine the information they collect on our Sites with information
about your visits to other sites to create market segments that they will use to more effectively advertise ourservices and those of other advertisers. Their tools may also limit the number of times you see the same
advertisement and help measure the effectiveness of our advertising campaigns.
Your Choices
EU Residents. You have the right to decide whether to accept or reject cookies. You can exercise your cookie
preferences here.
Opting-Out. You can set or change your web browser controls to accept or refuse cookies. The “help,” “tools,” or“edit” portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new
cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether.
If you disable cookies, you may still access our Sites but be aware that some features of our Sites may not function.
Most advertising networks offer you a way to opt out of targeted advertising. If you wish to not have this cross-site
information used for the purpose of serving you targeted ads, you may opt-out of many ad networks by clicking
here (or if located in the European Union, click here). Additional information is available at
http://www.aboutads.info/choices/ and http://www.youronlinechoices.com. Please note, we do not control any of
the above opt-out links and are not responsible for any choices you make using these mechanisms or thecontinued availability or accuracy of these mechanisms. You will continue to receive ads on the websites you visit,
but the ad networks from which you have opted out will no longer target ads to you based upon your activities onother sites.

Do Not Track. Some browsers have incorporated "Do Not Track" (DNT) features that can send a signal to thewebsites you visit indicating you do not wish to be tracked. Currently, our systems do not recognize browser “donot-track” requests. In the meantime, you can use the “help” portion of the toolbar on most browsers to learn
how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive
a new cookie, or how to disable cookies altogether as explained above.
Other Tracking Technologies.
Cookies are not the only way to recognise or track visitors to a website or an application. We and our third party
service providers may use other, similar technologies from time to time, like web beacons (sometimes called’tracking pixels’ or ’clear gifs’), which are tiny graphics with a unique identifier, similar in function to cookies. In
contrast to cookies, these web beacons are embedded invisibly on web pages and are not stored on your hard
drive. We might use web beacons to track the activities of Site visitors, to help us manage content, for targetedmarketing, and to compile statistics about usage. We and our third party service providers also might use clear
GIFs in HTML emails to our customers to help us track email response rates, identify when our emails are viewed,
and track whether our emails are forwarded. In many instances, these technologies are reliant on cookies tofunction properly, and so declining cookies will impair their functioning.
Updating this NoticeThis notice may be updated from time to time in order to reflect operational, legal, or regulatory changes. We will
notify you of any changes by posting the new notice on the Site and adjusting the “Last Updated” date. If you are a
Smartsheet customer and we make any material changes, we may notify you by email (sent to the email address
specified in your account) or by means of a notice through the Services prior to the change becoming effective.
How to Contact Us?
Please visit www.smartsheet.com/legal/privacy-notices for details on how to contact our Privacy Office.
Cookies Used in Our Services
We use the following cookies in connection with your access to and use of our Services for the purposes ofauthentication and session management.
[IN-APP COOKIE TABLES LISTED HERE]
Cookies Used on the Sites
Smartsheet uses the cookies listed below on the Sites. We engage a third party to scan our Sites and automaticallygenerate an up-to-date cookie table, as such this list may be updated from time to time. Smartsheet regularlymanually verifies this table (and updates it as needed). Where the purpose is “pending” below, this means that a
description was not automatically available and the manual update has not yet occurred.
This table applies only to: www.smartsheet.com, de.smartsheet.com, es.smartsheet.com, fr.smartsheet.com,
pt.smartsheet.com, it.smartsheet.com, ru.smartsheet.com, jp.smartsheet.com, community.smartsheet.com,
help.smartsheet.com, and developers.smartsheet.com.
[SITES COOKIE TABLES LISTED HERE]Smartsheet Candidate Privacy NoticeThis notice applies with respect to personal data we collect from applicants for employment, internships, andindependent contracting opportunities via our application forms, website, referrals, or other recruitment
channels.
Personal Data We Collect
How We Use Personal Data
How We Share Personal Data
Who We Are
Your Choices
Your Rights
Personal Data Retention
How We Protect Personal Data
ChildrenInternational Transfers and Privacy Shield Notice
Changes to this Notice
How to Contact Us
English Version Controls

Personal Data We Collect
From You•

Identification and contact details. This includes information such as your name, address, email address,
phone number and other contact information, as well as your gender, date of birth, nationality or
nationalities, and national identifiers (for example, national ID, passport, or social security number).

•

Employment history. This includes information about your previous employers and job titles.

•

Background information. This includes information like your academic and professional qualifications,education, details included in your CV or résumé (some of which could include details about memberships
or interests that reveal sensitive personal information about you), transcripts and employment
references.

•

Reference information. This includes information about your professional references that you share withus (including their name, contact information and job title, though it is your responsibility to get yourreferences’ consent to share their personal information with us), as well as information we receive frombackground checks (when we have them completed for a role), and information provided by other third
parties.

•

Previous applications and roles with us. This includes information about any prior applications you may
have made for a position with us or any previous employment history with us.

•

Your immigration or visa status. This includes information that would let us know if you are authorized orable to become authorized to work for one of our group companies.

•

Other information you voluntarily provide. This includes information that you may provide throughout therecruitment process, including, for example, through assessment exercises and interviews.

Unless permitted or required by law, there are certain types of information that we generally try to avoid
collecting. For example, information that reveals race or ethnicity, religious, political or philosophical beliefs ortrade union membership; genetic or biometric data; or information concerning your health/sex life ("Sensitive
Personal Data"). We may collect some Sensitive Personal Data from you for legitimate recruitment andemployment-related purposes, including meeting compliance obligations; providing accommodations fordisabilities; equal opportunity monitoring; for anti-discrimination purposes; and to satisfy reporting obligations.
Separately, you may choose to disclose, voluntarily, Sensitive Personal Data during the recruitment process. If
required by law, we will request your consent if we collect Sensitive Personal Data.
From Third Parties
We may gather Personal Data about you from third parties, including:•Professional references•

Background info provided or confirmed by academic institutions and training or certification providers•

Background checking agencies and other external database holders•

Recruitment or executive search agencies

•

Publicly available sources, including social media such as LinkedIn or other information available online (aspart of this, we may contact any mutual connections that are evident from publicly available information)

Automatically
We automatically gather personal data from our Site’s “Careers” page. The Careers page is available for you tovisit and search for open positions. For more details about the personal data we collect through our Sites, pleasesee our Cookie Notice.
How We Use Personal Data
We rely on these legal bases for the processing of personal data we collect under this notice. Where we rely on alegitimate business interest to process such information, we use the personal information in furtherance oflegitimate business interests that include:
Registering Office Visitors: To register visitors to our offices and to manage non-disclosure agreements that visitors
may be required to sign, to protect Smartsheet’s offices and confidential information against unauthorized access.
Protect Legal Rights and Prevent or Address Misconduct. To protect Smartsheet employees and other individuals;
prevent unauthorized access to Smartsheet; and where we believe necessary to investigate, prevent, or takeaction regarding illegal activities, suspected fraud, or situations involving potential threats to the safety of any
person.
Comply with Legal Obligations. To comply with the law or legal proceedings; for example, we may disclose
information in response to lawful requests by public authorities, including responding to national security or law
enforcement disclosure requirements.
General Business Operations. Where necessary to the administration of our general business, accounting,recordkeeping, employment, and legal functions.
Special Note Regarding European Union Applicants. For the personal data from the European Union that we
process, the relevant legal bases for such processing under the General Data Protection Regulation ((EU)
2016/679) (and local implementing laws of EU member states) include: (i) our legitimate business interests*; (ii)with your consent; (iii) compliance with law; and (iv) to establish, defend, or protect our legal interests. Thesebases do not limit or modify the obligations, rights, and requirements under the privacy laws of non-EU
jurisdictions.
*For the personal data from the EU, the processing is in our legitimate interests, which are not overridden by yourinterests and fundamental rights. Marketing to EU data subjects is done only with opt-in consent.

How We Share Personal Data
To Our Service Providers. We use third party service providers to process your personal data to assist us in businessand technical operations. Smartsheet has data processing agreements with such service providers limiting theiruse of and access to personal data to specific purposes. They provide services relating, but not limited toperforming services on our behalf and only in accordance with our instructions, or to comply with legal
requirements.
To Affiliates. We may share your personal data with our affiliates for employment opportunities and positions.
As Required by Law. We release information about you if we believe we must do so to comply with the law or a
subpoena, bankruptcy proceeding, or similar legal process. In certain situations, we may be required to disclose
personal data in response to lawful requests by public authorities, including to meet national security or law
enforcement requirements.
To Protect Rights. We may disclose information about you, such as your name and contact information, to enforce
our agreements with you or to protect the rights and safety of Smartsheet, our customers and users, and thegeneral public, or as evidence in litigation in which we are involved.
In a Business Transaction. If Smartsheet is involved in a merger, acquisition, or sale of all or a portion of its assets,
your information may be transferred to the acquiring entity as part of the transaction (provided that we inform thebuyer it must use your personal data only for the purposes disclosed in this notice), and may also be reviewed aspart of the due diligence review for the transaction (e.g.,we may need to provide a list of all customer accounts
and payment histories).