GlobalSign Privacy Policy Version 3.3
Updated March 31st, 2021
GlobalSign respects your right to privacy. This privacy policy has been developed to inform you
about the privacy practices followed by GlobalSign in connection with its websites, products andservices. This privacy policy applies where you have a direct relationship with GlobalSign – ie. if
you are one of our customers, contacts, suppliers, job applicants, contractors (or ex-employees orprevious contractors), then GlobalSign will be acting as data controller (make decisions) inrespect of the information that we hold on you. This privacy policy does not apply to products orservices offered by our partners, resellers or other third parties, or other third-party services or
websites, and we encourage you to read the privacy policies of those parties.
This privacy policy will inform you about what data is collected, how we use such data, wheredata is processed, how you may opt out of your data being used, the security provisions aroundstoring your data and how to correct, update or delete your data.
1.

Data Controller

The data controller for personal data collected by GlobalSign within the UK is GMO GlobalSign Ltd,
having its registered offices at Springfield House, Sandling Road, Maidstone, Kent, ME14 2LP,United Kingdom.
The data controller for personal data collected by GlobalSign within the EU is GMO GlobalSign NV,
having it’s registered offices at Diestsevest 14, 3000 Leuven, Belgium.
All questions or requests regarding the processing of data may be addressed to:
dpo@globalsign.com.
2.

Collection of Personal Information

We collect information from you when you (i) place an order for a GlobalSign digital certificate orother product or service, (ii) scan your servers for digital certificates using our Certificate
Inventory Tool (CIT), (iii) apply for access to our portal and/or managed service platforms, (iv)subscribe to our newsletter, (v) use our online chat service, (vi) download a white paper, (vii)
register for a webinar, (viii) respond to a survey, (ix) fill out a form for pre/post sales assistance,(x) open a support ticket, (xi) apply for a job at GlobalSign, (xii) share data with social media sites,or (xiii) attend a GlobalSign exhibit.
GlobalSign is a Certification Authority and trusted third party. To fulfill requests for digital
certificates or other products or services, you may be asked to enter your name, email address,
physical address, phone number, credit card information and/or organizational details or otherpersonal information.
-Contact information such as your name, email address, physical address, and phonenumber.
Relationship information that helps us do business with you, such as the types ofproducts and services that may interest you, contact and product preferences,
languages, marketing preferences and demographic data.
Vetting evidences such as ID documentation
Transactional information about how you interact with us, including purchases,inquiries, customer account information, billing and credit card information,

GlobalSign Privacy Policy v3.3

1 of 6

organizational details, transaction and correspondence history, and information about
how you use and interact with our website.
We may develop and acquire additional information about you by using third-party (public andprivate) data sources such as third-party databases and government agencies, as well as yourbrowsing and purchasing history in order to process orders for certificates and to improve ourservices.
GlobalSign treats personal information as confidential, except for the information included in anissued digital certificate. Such information may be verified using third party commercial andgovernment resources, and as such, is deemed to be public information.
3.

Purpose of Processing

Your personal data will be used for the purposes specified below:
3.1 To process applications for GlobalSign products and services
Your information is used to provide our products and services and order processing as well as toconduct business transactions such as billing.
3.2 To improve customer service
Your information helps us to more effectively respond to your pre/post sales requests andprovide technical support.
3.3 To send renewal notices
The email address you provide for order processing may be used to send you renewal notices foryour expiring digital certificate.
3.4 To send service updates
In addition, subject to your consent where required, we may send you new service updates,
security updates, related product or service information, and status updates on maintenancewindows or service availability.
3.5 To tell you about our products and services
Subject to your consent where required, we may send you periodic company newsletters,
information about our products and services that may be of interest to you based on your use ofother GlobalSign products and services, your attendance at GlobalSign sponsored marketing
events such as webinars or exhibitions, your requests for information about similar products andservices, or your sharing of data with social media sites such as LinkedIn or Facebook.
3.6 To process applications for jobs at GlobalSign
If you apply to work with us, your information is used to process your application.
4.

Legal Basis for Processing Personal Data

We will process your data for the purpose of performance of our contract with you or thelegitimate interest of GlobalSign, which are our usual business activities. In other cases, we will
request your consent for the processing of the personal data you may submit.
Your refusal to provide personal data to us for certain products and services may hinder us from
fulfilling your order for those products or services. Also, if you deny or withdraw your consent touse personal data or opt out of receiving information about GlobalSign products and services thismay result in you not being made aware of renewal notices, periodic company newsletters, newservice updates, security updates, related product or service information, and status updates on
GlobalSign Privacy Policy v3.3

2 of 6

maintenance windows or service availability. See section 10 below for how to withdraw yourconsent.
5.

Use of Cookies and web beacons

GlobalSign’s certificate management systems use cookies to enable the fulfillment of services.
Cookies may be used when you log into the system, purchase products or use certain system
functions.
In addition, like most online businesses, GlobalSign uses cookies and web beacons on ourwebsites and through marketing related emails to gather and analyze some personal data such as
the visitor’s IP address, browser type, ISP, referring page, operating system, date/time and basic
geographical information.
We use cookies and web beacons to compile aggregate data about site traffic and site interaction
so that we can gauge the effectiveness of our communications and offer better site experiences
and tools in the future. We may contract with third-party service providers to assist us in better
understanding our site visitors. These service providers are not permitted to use the informationcollected on our behalf except to help us conduct and improve our business.
First time visitors may choose to not have any activity monitoring cookies set in their browser.
We use an opt-out identification cookie to tag these users as having made this decision. Those
cookies that pertain to site performance, experience improvement and marketing areprogrammed not to execute when an opt-out cookie is present in a visitor’s browser. Opt-out
cookies persist until a visitor clears their browser cookies, or until their expiration one year after
the set date. A visitor is required to opt out again after one year in order to disable any activity
monitoring cookies.
More details of GlobalSign’s use of cookies can be found on our website athttps://www.globalsign.com/en/repository/cookie-policy/
6.

Use of application logs for diagnostics or to gather statistical information

Our servers automatically record information ("Application Log Data") created by your use of ourservices. Application Log Data may include information such as your IP address, browser type,
operating system, the referring web page, pages visited, location, your mobile carrier, device andapplication IDs, search terms, and cookie information. We use this information to diagnose andimprove our services. Except as stated in section 9 (Data Retention), we will either delete theApplication Log Data or remove any account identifiers, such as your username, full IP address, oremail address, after 12 months.
7.

Sharing of Information and Transfers of Data

We do not sell or trade your personal information to outside parties.
Within GlobalSign: GlobalSign is a global organization with business processes and technicalsystems in various countries. As such, we may share information about you within our groupcompany and transfer it to countries in the world where we do business in connection with theuses identified in section 3 above and in accordance with this Privacy Policy. In cases where yourpersonal data is transferred to countries that do not provide an adequate level of protection(‘adequacy decision’), we ensure your data is protected by entering into agreements containing
standard contractual clauses with each of our group companies. A copy of these agreements may
be obtained by contacting us as outlined in section 16 below.

GlobalSign Privacy Policy v3.3

3 of 6

Third Parties: We may also transfer your personal data to trusted third parties and our partners
in order to serve purposes that are specified in section 3 above. GlobalSign uses a third party toprocess credit card payments and provides credit card numbers and identifying financial data
directly to the third party credit card processor.
In circumstances where data is shared with such third parties, they are required to comply withconfidentiality terms included in our data processing agreements. This prohibits such thirdparties from selling, trading, using, marketing or otherwise distributing GlobalSign customer data.
As Required by Law: We may also release your information when we believe release isappropriate to comply with the law or protect our rights, property, or safety.
It is our policy to notify customers of requests for their data from law enforcement unless we areprohibited from doing so by statute or court order. Law enforcement officials who believe that
notification would jeopardize an investigation should obtain an appropriate court order or otherprocess that specifically precludes member notification, such as an order issued pursuant to 18
U.S.C. §2705(b).
Mergers & Acquisitions: We may also disclose your personal information to third parties who may
take over the operation of our site or who may purchase any or all of our assets, including yourpersonal information. We will contact you using the details you provide if there is any change inthe person controlling your information.
8.

International Transfers

The third parties, subsidiaries and affiliates to which your personal information can be disclosed
may be located throughout the world. Therefore, information may be sent to countries having
different privacy protection standards than your country of residence. In such cases, we takemeasures to ensure that your personal information receives an adequate level of protection by
only transferring your personal information to countries that have received an adequacy decision,or by entering into standard contractual clauses to protect your personal information.
9.

Data retention

The personal information we collect is retained for no longer than necessary to fulfil the statedpurposes in section 3 above or for a period specifically required by law or regulation that
GlobalSign is obligated to follow.
To meet public CA audit requirements as detailed in the GlobalSign Certification PracticeStatement, personal data used to fulfill verification of certain types of digital certificate
applications will be retained for a minimum of 10 years depending on the class of product orservice and may be retained in either a physical or electronic format. Please refer to theGlobalSign Certification Practice Statement for full details.
After the retention period is over, GlobalSign securely disposes or anonymizes your personal
information in order to prevent loss, theft, misuse, or unauthorized access.
10.

Opting out; withdrawing consent

If at any time you would like to unsubscribe from receiving future emails, we include unsubscribe
instructions at the bottom of each email.
Renewal notices may be cancelled on a per digital certificate basis by logging into your certificate
management system account and disabling renewal notices.
GlobalSign Privacy Policy v3.3

4 of 6

Email preferences for CIT related/collected information can be updated and changed within CIT.
If GlobalSign is processing your personal data based on your consent, you may withdraw yourconsent at any time via the GlobalSign Preference Centre athttps://preferences.globalsign.com/PreferencesCenter/ or by contacting us at one of theaddresses shown in section 16 below.
11.

Your Rights

You are responsible for providing GlobalSign with true, accurate, current and complete personalinformation. Also, you are responsible to maintain and promptly update the information to keep it
true, accurate, current and complete.
You have the right to access and modify your personal data stored on GlobalSign systems.
You can exercise your rights by contacting us in writing. We will require you to provide
identification in order to verify the authenticity as the data subject. We will make reasonable
efforts to respond to and process your request as required by law.
To the extent of applicable law, you may have the right to request erasure of your personal
information, restriction of processing as it applies to you, object to processing and the right todata portability. You also have the right to lodge a complaint with a supervisory authority.
If you provide any information that is untrue, inaccurate, not current or incomplete, or if we havereasonable grounds to suspect that such information is untrue, inaccurate, not current orincomplete, we have the right to suspend or terminate your account and refuse any and all current
or future services.
As a provider of services, GlobalSign may receive or have access to personal data on behalf of ourcustomers. Such information (“Customer Personal Data”) is owned and controlled by ourcustomers, the data controllers for such information. Customer information may include
information provided by the customer in support of certain services, such as identification datafor verification purposes. As a data processor of the Customer Personal Data, GlobalSign processes
the Customer Personal Data pursuant to the instructions from our customers. If GlobalSign
receives a data subject request, it may direct you to our Customer, as the controller of theCustomer Personal Data.
12.

How we protect your information

We implement a variety of security measures to maintain the safety of your personal information
when you place an order or enter, submit, or access your personal information. All supplied
sensitive/credit information is transmitted via Transport Layer Security (TLS).
After a transaction, your transaction-related information will be kept on file to meet audit
requirements and facilitate renewals. We do not retain any credit card details.
13.

COPPA

The Servies are not designed for, not marketed to, minors. We do not knowingly collect or solicit
personal information from minors, and we do not knowingly allow such persons to use theServices. If you are a minor, please do not attempt to use the Services or send any information
about yourself to us. In the event that we learn that we have collected personal information froma minor without verified parental consent, we will delete that information as quickly as

GlobalSign Privacy Policy v3.3

5 of 6

possible. If you believe we have any information from or about a minor, please contact us using
the contact information below
14.

Relevant laws

GlobalSign commits itself to protect the personal information submitted by applicants andsubscribers for its public certification services. GlobalSign declares to fully respect all rights
established and laid out in applicable regional laws and regulations.
15.

Changes to our Privacy Policy

If we make material changes to our privacy policy, we will inform customers by emailing a noticeof the availability of a new version with a link to the new version.
16.

Contact Us

If you have any inquires, or questions regarding our privacy policy, please contact us at:https://support.globalsign.com/
https://www.globalsign.com/en/company/contact/support/
https://jp.globalsign.com/support/
orDeputy Data Protection Officer
GMO GlobalSign, Ltd.
Springfield House Sandling Road
Maidstone, Kent ME 14 2LP
United Kingdom
dpo@globalsign.com
17.

Our Office Locations

GMO GlobalSign K.K., Tokyo, Japan
GMO GlobalSign Ltd., Maidstone, Kent, UK
GMO GlobalSign N/V, Leuven, Belgium
GMO GlobalSign, Inc., Portsmouth, NH, USA
GMO GlobalSign Russia LLC, Moskva, Russia
GMO GlobalSign Pte. Ltd, Anson, Singapore
GMO GlobalSign Certificate Services Pvt. Ltd., Delhi, India
GlobalSign China Co., Ltd., Shanghai, China
GMO GlobalSign Inc., Manila, Philippines
GMO GlobalSign FZ-LLC, Dubai, UAE

GlobalSign Privacy Policy v3.3

6 of 6