Review date: March 31, 2020

iSpring Privacy Policy
Effective starting May 25, 2018 (view previous version)
Contents
Introduction
Agreement to this Policy
How iSpring may collect information about you in our role as data controller
What information iSpring may collect about you in our role as data controller
Why iSpring processes your personal information in our role as data controller
How we share your personal information in our role as data controller
iSpring in its role as processor
Legal bases for processing
How we store and secure information we collect
How long we keep information (retention procedures)
How you can access and control your information
Notice to End Users
Our policy towards children
Changes to this Policy
Contact Us
Introduction
iSpring Solutions, Inc. and its affiliates (hereinafter referred to as “iSpring”) respects your right to privacy and weunderstand that, when you visit our website and use our products and services or otherwise interact with us (forexample, by viewing our webinars), you prefer to control the way you share your personal information (“Personal
Data”) and preferences. iSpring offers a wide range of products, including desktop products, our web-based
services, custom, and support services. We refer to all of these products, together with our other services andwebsites, as "Services" in this Privacy Policy.
The terms “we,” “us” and “our” refer to iSpring. The terms “user,” “you,” and “your” refer to site visitors,
customers and any other users of the site.
iSpring provides this Privacy Policy ("Policy") to inform you of our practices with respect to the collection and useof your Personal Data.
iSpring complies with the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the free movement ofsuch data (“GDPR”). iSpring acts as both a data controller and a data processor under GDPR.
iSpring has implemented the following requirements under the GDPR, including but not limited to:

A record of our Personal Data processing activities;
Adequate organizational and technical protection measures;Request forms and internal instructions for Privacy by Design & Default, Data Portability, and Data Subject
Rights like the Right to be Forgotten.

We collect information globally and primarily store that information on the servers based in the United States andGermany. We transfer, process, and store your information outside of your country of residence, to wherever weor our third-party service providers operate for the purpose of providing you the Services. The Personal Data of
individuals from the EEA and Switzerland is stored on servers based in Germany and processed in the United States.

Regardless of where your information is stored or processed, we apply the same protections described in thisPolicy. iSpring offers European builds of desktop products to individuals from the EEA and Switzerland to store theinformation we collect from your use of the Services on the servers in Germany. We also use the model contract
clauses approved by the European Commission as a means of ensuring adequate protection when transferring data
outside of the EEA and Switzerland. By incorporating model contract clauses into a contract established between
the parties transferring data, personal data can be protected when transferred outside the EEA to countries whichhave not been deemed by the European Commission to adequately protect personal data.
Agreement to this Policy
Please read this Policy carefully to understand our policies and practices regarding your information and how wewill treat it. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing
or using our Services, you agree to this Policy. This Policy may change from time to time. Your continued use of
our Services after we make changes is deemed to be acceptance of those changes, so please check the Policy
periodically for updates.
How iSpring may collect information about you in our role as data controller
We collect information about you and determine the purposes and means of processing your Personal Data in ourrole as data controller when you input it into the Services or otherwise provide it directly to us.
Site account and Profile Information: We collect information about you when you order Services from iSpring,
register to create a site account, create or modify your profile, set preferences, sign-up for or make purchases
through the Services. We keep track of your preferences when you select settings within the Services.
Information you provide through our support center: The Services also include our customer support, where
you may choose to submit information regarding a problem you are experiencing with a Service. Whether you
designate yourself as a technical contact, open a support ticket, speak to one of our representatives directly orotherwise engage with our support team, you will be asked to provide contact information, a summary of the
problem you are experiencing, and any other documentation, screenshots or information that would be helpful inresolving the issue.
Subscription to iSpring newsletters and webinars. We collect information about you when you subscribe to
our newsletters and webinars. You can set your communication preferences from your site account or opt-out at
any time.
Information we collect automatically when you use the Services
We collect information about you when you use our Services, including browsing our websites and taking certain
actions within the Services.
Your use of the Services: We keep track of certain information about you when you interact with any of ourServices. This information includes the features you use; information about the system configuration, PowerPoint
version you use; time you spent using the Services; the links you click on; the type, size and filenames ofattachments you upload to the Services; frequently used search terms; and how you interact with others on theServices.
Device and Connection Information: We collect information about your computer, phone, tablet, or otherdevices you use to access the Services. This device information includes your connection type and settings when
you install, access, update or use our Services. We also collect information through your device about your operating
system, browser type, IP address, URLs of referring/exit pages, device identifiers, and crash data. We use your IP
address and/or country preference in order to approximate your location to provide you with a better Service
experience.
Cookies: iSpring uses cookies to provide functionality and to recognize you across different Services and devices.
For more information, please see our Cookie Policy, which includes information on how to control or opt-out of thecookies and other tracking technologies.
Information we receive from other sources
We receive information about you from other Service users, from third-party services, from our related companies,
and from our business partners.
Other users of the Services: Other users of our Services may provide information about you when they submit
content through the Services. For example, you may be mentioned in a support ticket opened by someone else. Wealso receive your email address from other Service users when they provide it in order to invite you to theServices. Similarly, an administrator may provide your contact information when they designate you as the billingor technical contact on your company's site account.
iSpring Partners: We work with a global network of partners who help us to market and promote our products,
generate leads for us, and resell our products. Some of these partners provide consulting, training, and otherservices connected to our products. We receive information from these partners, such as contact information,company name, what iSpring products you have purchased or may be interested in, evaluation information you
have provided, what events you have attended, and what country you are in.
Other Partners: We receive information about you and your activities on the Services from third-party partners,
such as advertising and market research partners who provide us with information about your interest in andengagement with our Services and online advertisements.
What information iSpring may collect about you in our role as data controller
iSpring may collect the following information about you:














Your name, email address, phone number, company name, title and business/private address;
Your iSpring site account information – such as iSpring Services you ordered, domain name registration
information, the IP addresses assigned to you, the use of iSpring Services or any other information related
to your site account;Your contact with iSpring – such as a note or recording of a call you make to iSpring, a chat record when
you engage in a chat session with iSpring, an email or letter you send to iSpring or other records of any
contact you have with iSpring;
The email addresses of the users who receive the results of the test or dialogue simulations if the software
product with test or dialogue simulations functionality uses the function of collecting user data with sending
to an email address;
The email addresses of the users who pass tests or dialogue simulations created using the software productwith test/simulation functionality if the software product uses the function of collecting user data withsending to email addresses. You may create test or simulations with a user input form by sending the test
results to the server. Then iSpring does not receive any data, and all the data will be sent immediately toYour server;
The email addresses of the users (instructors) who receive the results of the test or dialogue simulations ofother users to review the test or quiz. You are responsible for submitting the correct email addresses while
using this functionality;
Information provided by you to iSpring when you notify iSpring of a (suspected) breach of acceptable useof iSpring Services;Your photo when you send us a testimonial and video footage of you when we record your video review
about iSpring Services.

Why iSpring processes your personal information in our role as data controller
iSpring processes your Personal Data for the following purposes:









Processing of orders and provision of Services;
Sending test or dialogue simulations results to You or users of the test or dialogue simulations;
Conducting market research, conducting retention and customer satisfaction surveys, conducting marketing
activities (including through email newsletters, social media and onsite/offsite and online/offline
advertisement), conducting sales activities (including analyzing your Personal Data and your use of iSpring
Services for making (personalized) offers and quotes with the aim of entering into a customer relationship,
and/or maintaining, renewing or expanding a customer relationship);Communicating with customers (a) to provide information about Services of iSpring and affiliatedcompanies, (b) to provide information about offers, orders, provision of Services, order status and payment,(c) to provide support and maintenance services, (d) to handle complaints, and (e) to answer questions
from (potential) customers;
Investigating and processing suspected violations of acceptable use of iSpring Services;
Complying with statutory obligations, including (a) provision of data to authorized authorities in the context
of criminal investigations, (b) complying with (applicable) data retention obligations, and (c) the provision
to third parties of Personal Data concerning customers in connection with an infringement of these third
parties’ rights.

How we share your personal information in our role as data controller

iSpring may share and disclose Personal Data about you
as described below. Please contact us at
support@ispring.com to opt out of the information sharing with a third party:







Authorized resellers, partners involved in delivering the Services, so that they can provide timely, helpful
information about iSpring Services. iSpring resellers and partners are contractually obligated to abide by
iSpring privacy policy, preventing them from sharing your information with any other third parties. You can
find
more
information
regardingiSpringauthorized
resellersandpartners
here
https://www.ispringsolutions.com/resellers;
Law enforcement agencies, regulatory organizations, courts or other public authorities to the extent
required by law;
An iSpring customer, if you notify iSpring that this customer use of iSpring Services violates the acceptable
use of iSpring Services or applicable law;
A third party that has claimed that your use of the iSpring Services violates the acceptable use of iSpring
Services or applicable law (to the extent such sharing is required by law);
In certain situations, iSpring may be required to disclose Personal Data in response to lawful requests by
public authorities, including to meet national security or law enforcement requirements.

iSpring in its role as processor
Personal information and content you provide through iSpring web-based services. When customers andiSpring partners use iSpring web-based services to process Personal Data in their content, iSpring acts as a dataprocessor. The customer of iSpring that owns an account in iSpring web-based services will be responsible fordetermining the purposes and means of the processing of the content and any Personal Data provided by end-usersof the account, and this iSpring customer (or its end users) will be the data controller in regards to such processing.
The owner of an account in iSpring web-based services has the right to update the email address associated withhis account or deactivate an account by submitting a written request to support@ispring.com.
If at any time iSpring has access to Personal Data stored in the account owned by an iSpring customer, then iSpring
shall be a data sub-processor, and any actions performed by iSpring in relation to such data shall be solely governedby the agreement concluded between us and the iSpring customer. iSpring offers a GDPR-compliant Data Processing
Addendum (DPA) that incorporates iSpring’s commitments as data processor.
Legal bases for processing
If you are an individual in the European Economic Area (EEA) or Switzerland, we collect and process information
about you only where we have legal bases for doing so under applicable EU laws. The legal bases depend on theServices you use and how you use them. To process your information as described above, we rely on the following
legal bases:Performance of a contract: the use of your information is necessary to provide you the Services,
customer support, and personalized features. If you order and use our Services, we will use your information
to carry out our obligation to complete and administer that Services under the contract that we have withyou;
Legitimate interests: the processing is necessary for the purposes of the legitimate interests pursued byus, namely for information security. We also want to provide you with the best suitable content of thewebsite, to improve and promote our products and services and the content on our website, and foradministrative, fraud detection and legal purposes;
Consent: we may rely on your consent to use your Personal Data for specific purposes, for example, forsending newsletters and for certain direct marketing purposes.

How we store and secure information we collect
Information storage. We use data hosting service providers in the United States and Germany to host the
information we collect, and we use technical measures to secure your data.
Technical and organizational security procedures and data transfers. We observe reasonable procedures toprevent unauthorized access to and the misuse of Personal Data. We use appropriate business systems andprocedures to protect and safeguard Personal Data. We also use security procedures and technical and physicalrestrictions for accessing and using the Personal Data on our servers. Only authorized personnel are permitted toaccess Personal Data in the course of their work.
For more information on where we store your information and our security measures, please contact us as provided
in the Contact Us section below.

Because iSpring is a company with customers located in many different countries around the world, it is importantthat we comply with data privacy laws in many jurisdictions. In our role as data processor, we have implemented
the model contractual clauses to enable the lawful transfer of Personal Data from the EEA and Switzerland to theUnited States. The Standard Contractual Clauses set out iSpring commitment to privacy and data protection whenprocessing data in connection with the provision of products and services to our customers and partners, anddealing with the transfer of Personal Data outside the EEA and Switzerland in connection with the provision of suchproducts and services. If you are a customer or partner that specifically requires the implementation of model
contractual clauses directly with iSpring, where appropriate and where iSpring is a data processor for the customer
or partner, please contact us as provided in the Contact Us section below.
How long we keep information (retention procedures)
iSpring will store your personal information for as long as necessary to perform the purposes of processing as statedin this Policy. After such time, we will either delete or anonymize your information or, if this is not possible (forexample, because the information has been stored in backup archives), then we will securely store your informationand isolate it from any further use until deletion is possible.
iSpring stores the email addresses of the users who receive the results of test or dialogue simulations for one (1)month in order to restore the results and send them to You or Your users. iSpring no longer uses this data: after amonth retention period, all the data will be deleted.
Site account information: We retain your site account information for as long as your site account is active anda reasonable period thereafter in case you decide to re-activate the Services. We also retain some of yourinformation as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, tosupport business operations, and to continue to develop and improve our Services. Where we retain informationfor Service improvement and development, we take steps to eliminate information that directly identifies you, and
we only use the information to uncover collective insights about the use of our Services, not to specifically analyze
personal characteristics about you.
Information you share on the Services: If your site account is deactivated or disabled, some of your informationand the content you have provided will remain in order to allow your team members or other users to make fulluse of the Services. For example, we continue to display messages you sent to the users that received them andcontinue to display the content you provided.
Managed accounts: If the Services are made available to you through an organization (e.g., your employer), we
retain your information as long as required by the administrator of your account.
Marketing information: If you have elected to receive marketing emails from us, we retain information about
your marketing preferences for a reasonable period of time from the date you last expressed interest in our Services,such as when you last opened an email from us or ceased using your iSpring site account. We retain information
derived from cookies and other tracking technologies for a reasonable period of time from the date such information
was created.
How you can access and control your information
Subject to some limits, you have certain rights regarding your Personal Data and the processing thereof. PLEASENOTE THAT OUR CUSTOMERS CONTROL AND MAINTAIN ACCESS TO THEIR DATA THAT IS STORED BY ISPRING,
AND WE MAY NOT HAVE ACCESS TO THE DATA MAINTAINED BY OUR CUSTOMERS OR EVEN KNOW WHAT DATA IS
BEING MAINTAINED.
You have the right to request a copy of your information, to object to our use of your information (including formarketing purposes), to request the deletion or restriction of your information, or to request your information in a
structured, electronic format. If you are an end-user and the Services are administered for you by an administrator(see section "Notice to End Users" below), you may need to contact your administrator to assist with your requests
first. For all other requests, you may contact us as provided in the Contact Us section below to request assistance.
Your rights:






You can access and update your information in your site account at any time;
You can deactivate your site account if you no longer wish to use our Services;
You can request the information iSpring has collected about you;
You can request that we make changes to the Personal Data you have seen, but cannot change in your siteaccount;
You also have the right to obtain from us the erasure of your Personal Data (right to be forgotten);









In addition, you may, under certain circumstances, have the right to restriction of the processing of your
Personal Data;
You have the right to object, on grounds relating to your particular situation, at any time to processing ofyour Personal Data;
You have the right to receive your Personal Data, which you have provided to us, in a structured, commonlyused and machine-readable format and have the right to transmit those data to another controller when
the processing is based on your consent or is necessary for the performance of a contract (the right to data
portability);
You can opt-out of promotional communications from us by using the unsubscribe link within each email,
updating your email preferences within your site account settings menu, or by contacting us as provided
below to have your contact information removed from our promotional email list or registration
database. Even after you opt-out of receiving promotional messages from us, you will continue to receive
transactional messages from us regarding our Services. You can opt-out of some notification messages inyour site account settings;
You can refuse the use of cookies: relevant browser-based cookie controls are described in our Cookie
Policy.

iSpring acknowledges that EU individuals have the right to access the personal information that we maintain about
them. An EU individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct
their query to support@ispring.com. If requested to remove data, we will respond within a reasonable timeframe.
Consent and withdrawal of consent. You are entitled to withdraw your consent at any time by giving us notice.
Upon receipt of a notice where your consent is withdrawn, we will without undue delay stop processing your Personal
Data to the extent it is required under the law. Please use the contact information at the bottom of the page should
you wish to withdraw your consent given under this privacy statement. To limit the use and disclosure of yourpersonal information, please submit a written request to support@ispring.com.
Notice to End Users
Our web-based services are intended for use by organizations. Where the web-based services are made available
to you through an organization (e.g., your employer), that organization is the administrator of the web-based
services and is responsible for the accounts in web-based services over which it has control. If this is the case,please direct your data privacy questions to your administrator, as your use of the web-based services is subject
to that organization's policies. We are not responsible for the privacy or security practices of an administrator'sorganization, which may be different than this policy.
Administrators are able to: reset your account password;
 restrict, suspend or terminate your access to the web-based services; access information in and about your account; access or retain information stored as part of your account; install or uninstall third-party apps or other integrations.
In some cases, administrators can also:
 restrict, suspend or terminate your account access; change the email address associated with your account; change your information, including profile information;
 restrict your ability to edit, restrict, modify, or delete information.
The administrator of the account in web-based services will assert administrative control over your account anduse of the web-based services.
You will be able to change the email address associated with your account only upon the administrator’s approval.
Please contact your organization or refer to your administrator’s organizational policies for more information.
Our policy towards children
The Services are not directed to individuals under 16. We do not knowingly collect personal information fromchildren under 16. If we become aware that a child under 16 has provided us with personal information, we willtake steps to delete such information. If you become aware that a child has provided us with personal information,please contact our support services.
Changes to this Policy
We may change this Policy from time to time. We will post any privacy policy changes on this page and, if thechanges are significant, we will provide more prominent notice by adding a notice on the Services homepages, loginscreens, or by sending you an email notification. We will also keep prior versions of this Policy in an archive foryour review. We encourage you to review our privacy policy whenever you use the Services to stay informed about
our information practices and the ways you can help protect your privacy.
If you disagree with any changes to this privacy policy, you will need to stop using the Services and deactivate youraccount(s), as outlined above.
Contact Us
If you have questions or concerns about how your information is handled, please direct your inquiry to iSpring
Solutions, Inc. If you are a resident of the EEA or Switzerland, please contact our EU Representative.
iSpring Solutions, Inc.
815 N. Royal Street, Suite 202,
Alexandria, Virginia, 22314
support@ispring.com
EU Representative:
lern.link, Guido Hornig
Kirchstr. 4, 82211 Herrschingdata-privacy-ispring@lernlink.de
Guido Hornig