Privacy Data Sheet

Doc type
Cisco public

Webex Meetings

This Privacy Data Sheet describes the processing of personal data (or personally identifiable information) byWebex Meetings.
Webex Meetings is a cloud-based and video conferencing solution made available by Cisco to companies or
persons who acquire it for use by their authorized users.

1. Overview

Webex Meetings (the “Service” or “Webex Meetings”) is a cloud-based web and video conferencing solution
made available by Cisco to companies or persons (“Customers,” “you,” or “your”) who acquire it for use by
their authorized users (each, a “user”). The Service enables global employees and virtual teams to collaborate
in real time from anywhere, anytime, on mobile devices or video systems as though they were working in thesame room. Solutions include meetings, events, training, and support services. For more information regarding
optional features for Webex Meetings, please see the Addendums below.
This Privacy Data Sheet covers Webex Meetings, Webex Webinars, Webex Training, and Webex Support. If you
use the Service together with the Webex App, see the Webex App Privacy Data Sheet (available on The Cisco
Trust Center) for descriptions of the data that may be collected and processed in connection with thoseservices.
For a detailed overview of the Service, please visit the Cisco Web Conferencing homepage.

2. Personal Data Processing

The Service allows users to instantly connect in a way that is almost as personal as a face-to-face meeting. If
you are a user and your employer is the Customer that acquired the Service, your employer serves as the “datacontroller” of data processed by the Service (see the Webex Meetings Privacy Data Map for a visualization of
who is doing what with data). The information described in the table below and in this Privacy Data Sheet isaccessible to your employer and is subject to your employer's policies regarding access, use, monitoring,deletion, preservation, and export of information associated with the Service.
Similarly, if users participate in meetings hosted by users in other companies, the meeting host and/or co-hostwill control any meeting recordings, files or other information shared during the meeting, which will be subject
to the host’s corporate policies regarding access, use, monitoring, deletion, preservation, and export of
information. The meeting host has the option to record meetings, which may be shared with others or
discoverable in a legal matter. In addition, meeting co-hosts and participants may also have the option torecord meetings, if this feature is enabled by the Customer in Webex Control Hub. The meeting host should
inform all meeting attendees prior to recording and Webex Meetings displays a red circle and plays an audio
prompt to all participants indicating that the meeting is being recorded. Note, Cisco has no control over and is
not responsible or liable for the privacy of any information that you have shared with others. Even after you
remove information from the Webex Meetings platform, copies of that information may remain viewableelsewhere to the extent it has been shared with others.
Webex Meetings does not:•••Produce decisions that would result in legal or other significant effects impacting the rights ofdata subjects based solely by automated means.
Sell your personal data.
Serve advertisements on our platform.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public•••

Track your usage or content for advertising purposes.
Monitor or interfere with your meeting traffic or content.
Monitor or track user geolocation.

Because the Service enables collaboration among its users, your personal data is required to use the Service.
Cisco will process your personal data consistent with this Privacy Data Sheet and in accordance with yourinstructions. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is the Data
Controller for personal data processed to administer, manage, and improve the customer relationship andservice. Cisco is the Data Processor for personal data processed by the Service solely to provide its
functionality.
The table below lists the personal data processed by Webex Meetings to provide its services and describes
why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information

•
•
•
•
•
•
•

Name
Email Address
Password
BrowserPhone Number (Optional)
Mailing Address (Optional)
Profile Picture or Avatar image(optional, only applicable ifprovided by you)
User Information Included inYour Directory (if synced)
Unique User ID (UUID) (apseudonymized 128-bit
number assigned to computenodes on a network)

•
•
•
•
•
•

IP Address
User Agent Identifier
Hardware TypeOperating System Type andVersion
Client Version
IP Addresses Along the
Network Path MAC Address ofYour Client (as applicable)
Service Version
Actions Taken
Geographic Region (i.e.,Country Code)
Meeting Session Information(e.g., date and time,
frequency, average and actual
duration, quantity, quality,
network activity, and network
connectivity)
Number of Meetings
Number of Screen-Sharing
and NonScreen-Sharing
Sessions
Number of Participants
Screen Resolution
Join Method
Performance,
Troubleshooting, and

•
•
•

•
•

Host and Usage
Information

•
•
•
•
•
•

•
•
•
•

•
•

•
•
•
•

©2024 Cisco and/or its affiliates. All rights reserved.

•
•

•
•

•
•
•

Provide you with the Service
Enroll you in the Service
Respond to Customer support requests
Authenticate and authorize access to your accountDisplay directory information to other Webex users
Display your user avatar and profile to other users(Avatar may be cached locally on devices of otherWebex users that attend meetings with you for aperiod of 2 weeks)
Customer relationship management (e.g.,transactional communication)
Bill you for the Service

Provide you with the Service
Diagnose technical issues
Conduct analytics and statistical analysis for Customer
to provide Customer administrators visibility intousage
Respond to Customer support requests
Help organize, sort, and/or prioritize your Webex App
messages or spaces in a way that is relevant to you
and your work
Provide you the Collaboration Insights feature(including Personal Insights) (optional)
Bill you for the Service
Diagnostic and troubleshooting purposes

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

•

•
•

•

User-Generated
Information

•

•

•
•

•

•

Webex-Generated Content••

Diagnostics Information
Meeting Host Information1o Host Name and Email
Addresso Meeting Site URL
o Meeting Start/End Time
Meeting Title
Call Attendee Information,
including Email Addresses, IP
Addresses, Usernames, Phone
Numbers, Room Device
Information
Information Submitted
Through Attendee Registration
Form (optional, only applicable
if provided by you)
Meeting Recordings (optional,
only applicable if enabled byyou)Transcriptions of Meeting
Recordings (optional, only
applicable if enabled by you)
Uploaded Files (optional, only
applicable if enabled by you)Whiteboard content (optional,
only applicable if enabled byyou)
Chat Messsages (optional,
only applicable if enabled byyou)
Annotations (optional, only
applicable if enabled by you)•

Provide you with the Service

AI Assistant-Generated
Content (optional, only
applicable if the AI Assistantfeature is enabled by you)
Images from the user’s
camera feed during a Meeting(optional, only applicable if thecamera is turned on and theapplicable feature(s) areenabled by you)•

Provide you with the Service

CalendarIf you use a Webex plug-in with your Calendar service, we will only use the data set forth above regarding
meeting dates, times, title and participants. For more information on Webex Hybrid Calendar Service see the
Office 365 and Google Calendar integration references.

Technical Support Assistance

If a Customer reaches out to Cisco Technical Assistance Center (TAC) for problem diagnosis and resolution,
Cisco TAC may receive and process personal data from the Service. The Cisco TAC Service Delivery Privacy
Data Sheet describes Cisco’s processing of such data.

Control Hub

Webex Control Hub analytics provides usage trends and valuable insights that can be used to help withstrategies to promote and optimize adoption across teams. Webex Control Hub analytics uses Host and Usage

1

Used for billing purposes.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Information to provide advanced analytics capabilities and reports.

Polling

As a presenter, you can use a poll to create and share questionnaires. Any polling data collected fromparticipants will be deleted once the meeting has ended. Some Webex Meetings may feature Slido, which is a
cloud-based polling and Q&A solution; for details around the processing of personal data by the Slido feature,please see Addendum 6 to this Privacy Data Sheet.

Extended Security Pack

If you purchase the extended security pack, please see the Cloudlock Privacy Data Sheet for Cloudlock data
privacy information.

3. Data Center Locations

The Service leverages its own data centers as well as third-party cloud hosting providers to deliver the Service
globally. [If you join a meeting using Webex App, please see the Webex App Privacy Data Sheet for applicableprivacy information, including data center locations.] Those data centers are currently located in the following
countries (data center locations may change from time to time and this Privacy Data Sheet will be updated toreflect those changes):

User-Generated Information and Webex-Generated Content are stored in the data center in Customer’s region
as provided during the ordering process. Data is replicated across data centers within the same region toensure availability.
An Internet Point of Presence (iPOP) Location is used to route traffic geographically from nearby areas to a
Cisco Data Center Location. It is intended to route Webex Meetings traffic through Cisco's infrastructure andimprove performance. Data routed through iPOP Locations remains encrypted and is not stored in that location.
For free user accounts, the data defined in this Privacy Data Sheet may be stored in a Webex data center
outside the account holder’s region.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Data Center Locations

Internet Point of Presence (iPOP) Locations

Amsterdam, Netherlands

Amsterdam, Netherlands

Bangalore, India

California, USA

California, USA

Illinois, USA

Frankfurt, Germany

New Jersey, USA

London, UK

Sydney, Australia

Montreal, Canada

Texas, USA

New York, USA
North Carolina, USA
Singapore, Singapore
Sydney, Australia
Texas, USA
Toronto, Canada
Virginia, USA

4. Webex Data Residency

Webex data residency provides Customer administrators (or partner administrators on the Customer's behalf)
the ability to choose where their organization’s data is stored. Data residency is currently available for
Customers in the European Union (EU) (“EU Customers”), Customers in Canada (“Canadian Customers”), andCustomers in the United States (“US Customers”) for personal data processed by Webex Meetings, including
User Information, Host & Usage Information, User-Generated Information, and AI Assistant-Generated Content(other than as noted below).2 EU Customers that became Webex Meetings Customers after July 2021, canchoose to provision their data in the EU. For EU Customers who were provisioned before July 2021, Customer
administrators were offered the option to migrate their user data to the EU, and this was completed as ofDecember 2021. Canadian Customers that became Webex Meetings Customers after July 2022, can choose toprovision their data in Canada. For Canadian Customers who were provisioned before July 2022, Customer
administrators were offered the option to migrate their user data to Canada. US Customers who areprovisioned in the US by their Customer administrators will have their personal data processed and stored in
the US.
To facilitate certain operations and aspects of the Service, certain exceptions to Webex data residency exist;
specifically, cross-border transfers of personal data may still occur when (a) a user registers on any Cisco
platform (for example, through www.webex.com or www.cisco.com) or through any Cisco service to learn
more about Cisco products or events; (b) a Customer provides ordering information (business contact
information); (c) a user engages in collaboration with users outside of their region; (d) a user requests technicalsupport, including through Cisco TAC (in which case the information that a user provides within the initial TAC
2

For Canadian Customers, certain Usage Information, including Usage Information related to billing will continue to be stored in the US.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

request may be transferred outside the region); (e) a user enables certain optional functionalities; or (f) a user
enables cell phone “push” notifications (in which case the cell phone provider associated with iOS or Android
functionality may transfer data outside of the region).
For free user accounts, the data defined in this Privacy Data Sheet may be stored in a Webex data center
outside the account holder’s region, including for EU and Canadian Customers.

5. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:
•
•
•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses
EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework

6. Access Control

The table below lists the personal data used by Webex Meetings to carry out the Service, who can access thatdata, and why.
Personal Data Category

Who has AccessPurpose of the Access

User Information•

User through My Webex Page•

Modify, control, and delete User
Information•

Customer through the Site Admin Pageor Webex Control Hub•

Modify, control, and delete inaccordance with Customer’s personal
data policy

•

Cisco

•

Support the Service in accordancewith Cisco’s data access and security
controls process•

Host through the My Webex Page•

View meeting session information•

Customer may view this information
through the Site Admin Page, Webex
Control Hub, or may be otherwise
provided by Cisco•

View usage, meeting session andconfiguration information

•

Cisco

•

Diagnostic and troubleshooting•

User through the My Webex Page•

Modify, control, and delete based onuser’s preference•

Customer using APIs provided with theService or through the Site Admin Pageor Webex Control Hub•

Modify, control, and delete inaccordance with Customer’s personal
data policy

•

Cisco

•

While Cisco operates the Service,
Cisco will not access this data unless
it is shared with Cisco by Customer,
and will only access it in accordance

Host and Usage Information

User-Generated Information©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco publicwith Cisco’s data access and security
controls process

Webex-Generated Content•

Other Customers and users (whenshared during a meeting)•Content you choose to share during ameeting may be accessed by users in
the meeting, wherever they arelocated. Even after you remove
information from the Service, copiesof that content may remain viewableelsewhere to the extent it has beenshared with others•

Users through the My Webex Page•

Modify, control, and delete based onuser’s preference•

Customer using APIs (if any areprovided with the Service) or throughthe Site Admin Page or Webex Control
Hub•

Modify, control, and delete inaccordance with Customer’s personal
data policy

•

Cisco

•

While Cisco operates the Service,
Cisco will not access this data unless
it is shared with Cisco by Customer,
and will only access it in accordancewith Cisco’s data access and security
controls process

7. Data Portability

The Service allows Customers and users to export all User-Generated Information and Webex-Generated
Content. A Customer’s administrator may do so using APIs provided with the Service (recordings only) or
through the Site Admin Page, while individual users may do so through the My Webex Page. Meeting
recordings are available in standard mp4 format.
Customers are permitted to export personal data collected about their users on the Webex Meetings platformusing APIs or via the Site Admin Configuration.

8. Data Retention

Subject to their employer’s corporate retention policies, users with an active subscription can delete UserGenerated Information from their account through the My Webex Page at any time during the term of theirsubscription. Users with an active enterprise or paid online subscription may also request their organization’s
full administrator(s) to delete their host and usage information. Enterprise Customers have the ability to set
organization-wide retention periods for recordings using APIs. Cisco provides free account users up to 6
months of free storage.
The table below lists the personal data used by Webex Meetings, the length of time that data needs to beretained, and why we retain it.
Users seeking deletion of User Information, User-Generated Information and Webex-Generated Content
retained on their employer’s Webex Meetings site must request deletion from their employer’s site
administrator.
Type of Personal Data

Retention Period©2024 Cisco and/or its affiliates. All rights reserved.

Reason for Retention

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
User Information

Active Subscriptions:•
As long as
Customer maintains
active subscription(paid or free)

Name and UUID are maintained as part of Cisco’s businessrecords and to comply with Cisco’s financial and audit
requirements. See below regarding billing information.

Terminated Service:•
Deleted once theService isterminated•
Name and UUID aremaintained 7 years
from termination
Host and Usage
Information

13 months (7 years for billinginformation)

Host and Usage Information such as analytics and troubleshooting
is kept to provide technical support when requested by customers
and to improve the experience for Webex users.
* Any billing information is retained for 7 years as part of Cisco’s
business records and is maintained to comply with Cisco’s
financial and audit requirements. Once the specified retention
period has expired, data will be deleted.

User-Generated
Information

Active Subscriptions:•
Except recordings at Customer’s oruser’s discretion•
Recordings –retained for 30 days
Terminated Service:•
Deleted within 60
days

Webex-Generated
Content

Active Subscriptions:•
At Customer’s oruser’s discretion•
AI Assistantgenerated content
maintained for 7
days fromgeneration

User-Generated Information, except for recordings, is not retainedon the Webex Meetings platform when Customer or user deletes
this data. It is retained for 60 days after services are terminated togive customers the opportunity to download it.
Recordings are “soft deleted” and retained for 30 days before
being removed from the platform to allow a Customer or user toretrieve a recording the user has inadvertently deleted.

Webex-Generated Content generally is not retained on the Webex
Meetings platform when Customer or user deletes this data.
AI Assistant-generated content is retained to allow a Customer oruser to download it . (If Customer or user deletes this data during
the 7 day period, it is no longer retained.)
Images from the user’s camera feed during a Meeting, which areprocessed to provide the functionality of certain optional featuresthat use the images, such as like the Auto Step Away feature or
the Virtual Background, Blur and Effects feature, are not retainedon the Webex Meetings platform.

9. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure. These technical andorganizational measures include the following:
Personal Data Category

Security Controls and Measures

User Information

Encrypted in transit and at rest

Passwords (stored if Single Sign On is
not configured)

Encrypted and hashed in transit and at rest

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Host and Usage Information

Encrypted in transit and at rest

User-Generated Information

Recordings prior to May 2018 were encrypted in transit with the option to encrypt atrest. Recordings created after May 2018 are encrypted in transit and at rest by
default. Recordings created in the Webex Meetings FedRAMP-Authorized service
after October 2019 are encrypted in transit and at rest.
Encrypted in transit and at rest

Webex-Generated Content

Protecting Data at Rest

The Service encrypts User Information, Passwords, User-Generated Information, and Webex-Generated
Content, as described above, at rest.

Encryption of Data in Transit

All communications between cloud registered Webex App, Webex Room devices and Webex services occur
over encrypted channels. Webex uses the TLS protocol with version 1.2 or later with high strength cipher suites
for signaling.
After a session is established over TLS, all media streams (audio VoIP, video, screen share, and document
share) are encrypted.
Encrypted media can be transported over UDP, TCP, or TLS. Cisco prefers and strongly recommends UDP as
the transport protocol for Webex voice and video media streams. This is because TCP and TLS are connection
orientated transport protocols, designed to reliably deliver correctly ordered data to upper-layer protocols.
Using TCP or TLS, the sender will retransmit lost packets until they are acknowledged, and the receiver will
buffer the packet stream until the lost packets are recovered. For media streams over TCP or TLS, thisbehaviour manifests itself as increased latency/jitter, which in turn affects the media quality experienced by thecall’s participants.
Media packets are encrypted using either AES 256 or AES 128 based ciphers. The Webex App and Webex
Room devices use AES-256-GCM to encrypt media; these media encryption keys are exchanged over TLSsecured signalling channels. SIP and H323 devices that support media encryption with SRTP can use AES256-GCM, AES-128-GCM, or AES-CM-128-HMAC-SHA1 (AES-256-GCM is the Webex preferred media
encryption cipher).

Zero Trust Security Based End-to-End Encryption

For standard Webex Meetings, where devices and services use SRTP to encrypt media on a hop by hop basis,
Webex media servers need access to the media encryption keys to decrypt the media for each SRTP call leg.
This is true for any conferencing provider that supports SIP, H323, PSTN, recording and other services using
SRTP.
However, for businesses requiring a higher level of security, Webex also provides end-to-end encryption for
meetings (“Webex Zero Trust Security end-to-end encryption”). With this option, the Webex cloud does nothave access to the encryption keys used by meeting participants and cannot decrypt their media streams.
Webex Zero Trust Security end-to-end encryption uses standard track protocols to generate a shared meeting
encryption key (Messaging Layer Security (MLS)) and to encrypt meeting content (Secure Frame (S-Frame).
With MLS, the meeting encryption key is generated by each participant’s device using a combination of theshared public key of every participant and the participant’s private key (never shared). The meeting encryption
key does not traverse the cloud and is rotated as participants join and leave the meeting. For more details on
Zero Trust Security based end-to-end encryption see the Zero Trust Security for Webex white paper.
With end-to-end encryption, all meeting content (voice, video, chat, etc.) is encrypted using the locally derived
meeting encryption key. This data cannot be deciphered by the Service.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Note that when end-to-end encryption is enabled, Webex services and endpoints that need access to meetingkeys to decrypt content (e.g., devices using SRTP where encryption is performed hop by hop) are notsupported. This restricts meeting participants to those using the Webex App or cloud registered Webex
devices only, and excludes services such as network-based recording, speech recognition etc. The following
features are also not supported:
•
•
•
•
•
•
•

Join Before Host
Video-device enabled meetings
Linux clients
Network-Based Recording (NBR)
Webex Assistant
Saving session data transcripts, Meeting notes
PSTN Call-in/Call-back

10. Sub-processors

We may share data with service providers, contractors or authorized third parties to assist in providing andimproving the Service. We do not rent or sell your information. All sharing of information is carried out
consistent with the Cisco Privacy Statement and we contract with third-party service providers that can provide
the same level of data protection and information security that you can expect from Cisco. Below is a list of
sub-processors for Webex Meetings. Data shared with these sub-processors follows Webex data residency,
except for those sub-processors who may be implicated by one of the exceptions listed in Section 4.
All Cisco sub-processors undergo a rigorous security and privacy assessment to confirm their compliance with
our requirements. They are further bound by a data processing agreement which incorporates the EU Standard
Contractual Clauses and places strict limits on their use and processing of any data provided by us or our Webex
customers and users.
Sub-processor

Personal Data

Service Type

Location of Data
CenterAkamai••

Akamai is used as content delivery network(CDN) services provider for static content.

Location generally
maps toCustomer’s Webex
data centerassignment.

IP Address
Browser andGeographic Region

Akamai does not store content but may store
IP addresses in logs for a maximum of 3 years.

To the extent
Akamai receives IP
addresses ofWebex Meetings
Customers, thoseIP addresses may
be transmitted to
the United Stateswith strict access
control means andappropriate
safeguards under
the EU Standard
Contractual
Clauses (SCCs).
Amazon Web Services
(AWS)

•

Limited Host & Usage
Information

AWS cloud infrastructure is used to host theWebex signaling service that processes
meeting participant UUIDs, meetings start and©2024 Cisco and/or its affiliates. All rights reserved.

United States
Germany
Netherlands

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public•

Meeting Recording
Files (if applicable)

end times. Data will be deleted within 15 daysof the meeting. (Location maps to Customer’s
Webex data center assignment.)
AWS cloud infrastructure is used to hostWebex media nodes that may process realtime meeting data such as VoIP, video andhigh frame rate sharing data. This information
is not retained in AWS once your meeting has
ended.

United Kingdom
BrazilAustralia
Japan
Singapore

AWS cloud infrastructure is also used to store
Meetings recording files, if meeting record isenabled by the Customer. (Location maps toCustomer’s Webex data center assignment).
Microsoft••••

Enrollment
information
Host & Usage
Information
User Generated
Information
Webex Generated
Content

Microsoft is leveraged to provide certain AI
Assistant features

European Union(and Switzerland)
United States

If a Customer acquires the Service through a Cisco partner, we may share any or all of the information
described in this Privacy Data Sheet with the partner. Customers have the option of disabling this informationsharing with Cisco partners. If you use a third-party account to sign-in to your Webex account, Cisco may
share only the necessary information with such third party for authentication purposes.

11. Information Security Incident Management
Breach and Incident Notification Processes

The Information Security team within Cisco’s Security & Trust Organization coordinates the Data Incident
Response Process and manages the enterprise-wide response to data-centric incidents. The Incident
Commander directs and coordinates Cisco’s response, leveraging diverse teams including the Cisco Product
Security Incident Response Team (PSIRT), the Cisco Security Incident Response Team (CSIRT), the Advanced
Security Initiatives Group (ASIG), and Cisco Legal.
PSIRT manages the receipt, investigation, and public reporting of security vulnerabilities related to Cisco
products and networks. The team works with Customers, independent security researchers, consultants,
industry organizations, and other vendors to identify possible security issues with Cisco products and networks.
The Cisco Security Center details the process for reporting security incidents.
The Cisco Notification Service allows Customers to subscribe and receive important Cisco product andtechnology information, including Cisco security advisories for critical and high severity security vulnerabilities.
This service allows Customers to choose the timing of notifications, and the notification delivery method (email
message or RSS feed). The level of access is determined by the subscriber's relationship with Cisco. If you
have questions or concerns about any product or security notifications, contact your Cisco sales representative.

12. Certifications and Compliance with Privacy Requirements

The Security & Trust Organization and Cisco Legal provide risk and compliance management and consultation
services to help drive security and regulatory compliance into the design of Cisco products and services. The©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Service is built with security and privacy in mind and is designed so that it can be used by Cisco customers in amanner consistent with global security and privacy requirements, including the EU General Data Protection
Regulation (GDPR), California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Canada’s
Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Health Information
Protection Act (PHIPA), Health Insurance Portability and Accountability Act (HIPAA), and Family Educational
Rights and Privacy Act (FERPA).
Further, in addition to complying with our stringent internal standards, Cisco also maintains third-party
validations and certifications to demonstrate our commitment to information security and privacy. The Service
has received the following certifications:

•

•
•
•
•
•
•
•
•
•
•
•

EU Cloud Code of Conduct Adherence by SCOPE EuropeoFor more information about the EU Cloud of Conduct see: Cisco Webex EU Cloud Code of
Conduct and the Verification of Declaration of Adherence.
ISO/IEC 27001:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019 Certification
SOC 2 Type II Report
BSI Cloud Computing Compliance Criteria Catalogue (German C5)
CSA STAR Level 2 Certification
FedRAMPHIPAA Attestation
Spanish Esquema Nacional de Seguridad Certification
Italian AgID (Agency for Digital Italy) Certification
Australian IRAP (Information Security Registered Assessors Program) Certification
Digital Trust Label (Switzerland)Electronic Transactions Development Agency Certification (Thailand)

13. Exercising Data Subject Rights

Users whose personal data is processed by the Service have the right to request access, rectification,suspension of processing, data portability, and/or deletion of the personal data processed by the Service aswell as object to processing.
We will confirm identification (typically with the email address associated with a Cisco account) before
responding to the request. If we cannot comply with the request, we will provide an explanation. Please note,users whose employer is the Customer/Controller, may be redirected to their employer for a response.
Requests can be made by submitting a request via:
1) the Cisco Privacy Request form
2) by postal mail:Chief Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAmericas Privacy Officer

APJC Privacy Officer©2024 Cisco and/or its affiliates. All rights reserved.

EMEA Privacy Officer

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESCisco Systems, Inc.
Bldg 80, Lvl 25, Mapletree Biz
City,
80 Pasir Panjang Road,
Singapore, 117372
SINGAPORE

Cisco Systems, Inc.
Haarlerbergweg 13-19, 1101 CH
Amsterdam-Zuidoost
NETHERLANDS

We will endeavor to timely and satisfactorily respond to inquiries and requests. If a privacy concern related tothe personal data processed or transferred by Cisco remains unresolved, contact Cisco’s US-based third-party
dispute resolution provider. Alternatively, you can contact the data protection supervisory authority in yourjurisdiction for assistance. Cisco’s main establishment in the EU is in the Netherlands. As such, our EU leadauthority is the Dutch Autoritiet Persoonsgegevens.

14. General Information

For more general information and FAQs related to Cisco’s Security and Privacy Program please visit The Cisco
Trust Center.
This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement. To the extent this document
differs from the Cisco Online Privacy Statement, this document will take precedence. If there is a difference intranslated, non-English versions of this document, the U.S.-English version will take precedence.
Cisco frequently evolves and updates its offerings. Cisco Privacy Data Sheets are subject to change and arereviewed and updated on an annual basis or as reasonably needed to reflect a material change in theprocessing of Personal Data. For the most current version, go to the Personal Data Privacy section of the Cisco
Trust Center.
To receive email notifications of updates to the Privacy Data Sheet, click the “Subscribe” link in the upper rightcorner of the Trust Portal.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Addendum One: People Insights for
Webex

This Addendum describes the processing of personal data (or personal identifiable information) by People
Insights for Webex Meetings and the Webex App.
People Insights for Webex Meetings and the Webex App is a cloud-based company directory solution madeavailable by Cisco to companies or persons who acquire it for use by their authorized users.
Cisco will process personal data from People Insights for Webex Meetings and the Webex App in a mannerthat is consistent with this Privacy Data Sheet. In jurisdictions that distinguish between Data Controllers andData Processors, Cisco is the Data Controller for the personal data processed to administer and manage theCustomer relationship. Cisco is the Data Processor for the personal data processed by Webex Meetings andthe Webex App to provide its functionality.

1. Overview

The People Insights feature (“People Insights” or the “Feature”) provides Webex Meetings and Webex App
users with comprehensive, publicly available business and professional information for meeting participants
giving users context and increased insight about the people with whom they collaborate. People Insights only
displays publicly available information, similar to what can be found in search engine results for a person’sname and profession. People Insights will also display internal company directory information to users in thesame company. This internal directory information is not visible to users outside the company. The People
Insights database does not look behind logins or paywalls, which means your profile will not be populated with
content from sites like Facebook.
People Insights was designed with data protection and privacy in mind, and is aligned to global privacy
requirements, including GDPR. This Feature provides users with a convenient single view into their alreadyexisting public presence and digital footprint. As outlined below, People Insights includes functionality to honor
data subject rights. Users fully own their People Insights profile and can change or hide the profile to keep
information private.
People Insights is enabled by default for U.S. provisioned Customers. Customers provisioned in the EU must
opt-in to this feature. Users at an enabled organization can opt out of People Insights by suppressing theirprofile in the Webex App. This is accomplished by signing into people.webex.com and clicking on “HideProfile.”If you join a Webex Meeting, or a space in Webex App, hosted by a Cisco Customer that has People Insights
enabled on their Site Admin Page or Webex Control Hub, all participants’ People Insight profiles will be visible
unless they have chosen to hide their profiles as described above.

2. Personal Data Processing

People Insights compiles business and professional profiles for Webex App users and Webex Meetingsparticipants using publicly available and legitimately sourced information, published authored works, news
articles, search engine results, via APIs and through content supplied by the profile owner.
The table below lists the personal data processed by People Insights to provide the Feature and describes why
the data is processed.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Personal Data Category

Type of Personal Data

Purpose of Processing

Publicly Available Businessand Professional
Biographical Data

•
•
•
•
•
•
•
•

Profile Photos
News
TweetsAuthored Works
Bios
Employment History
Education History
Web Links for a specificperson••Provide you with the Feature
To source the People Insights profile and to enablesearch within the Feature

Account & Usage
Information

User Level Account Details(including email, name, and webinteractions and platform usage)••

Provide you with the Feature
Product analytics (e.g., frequency of profile edits,
number of successful profile loads in a meeting, etc.)

Directory Data•

If the directory option isenabled by the site
administrator, professional
information including thefollowing may be collectedfrom the internal company
directory (as selected by theadministrator):
•
Title
•
Phone Number•
Location•
Organization•
Department
•
Photo
•
Role
•
Reporting Structure•
Pronouns (optional, only
applicable if available inyour organization)••

Provide you with the Feature
To augment the user’s People Insights profile byproviding company specific context to Webex App
users and Webex Meetings participants who belong to
the same organization. This data will only be visible toparticipants within the user’s organization.

User-Generated
Information•

Information that the user adds
in their People Insights profile.

••

Provide you with the Feature
Augment the user’s own People Insights profile(visible to People Insights users)

3. Data Center Locations

People Insights data is stored on third party servers provided by Amazon Web Services (“AWS”). AWS servers
are located in the United States.

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public••

EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework

5. Access Control

The table below lists the personal data used by People Insights, who can access that data, and why.
Personal Data Category

Who has AccessPurpose of the AccessPublicly Available
Business andProfessional Biographical
Data

•

Cisco

•

To provide the Feature•

Account & Usage
Information•

Users of Customer Webex sitewith enabled People Insights
Cisco

•
•
•

Registration Support
Correlate users with correct profiles
Analytics to improve service•

Customer•

Feature enablement/disablement••

Customer (Admin)
People Insight users within the
Customer’s organization•

Directory data is provided and maintained by Customer
administrator to allow integration into People Insights
profile

•

Cisco

•

Directory data is imported and integrated with Customer
profile data to support profile development

•

User

•

Users may access their own User-Generated Information
to edit or delete content

Directory Data

User-Generated
Information

6. Data Portability

Individuals can receive a copy of their own People Insights profile, including their self-generated information,
through the Cisco Privacy Request form.

7. Data Retention

The table below lists the personal data used by People Insights, the length of time that data needs to beretained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

Publicly Available
Business & Professional
Data

Obtained from public websites:
three (3) years

Publicly Available Business & Professional Data is derived frompublic sources. It is retained for three (3) years. Upon request,
publication and links to source data can be suppressed andrestricted from view and publication.

Obtained through third-party
APIs: In accordance with
contractual requirements

As publicly available data originates from outside of the Webex
App and Webex Meetings, any permanent changes or deletions
must be addressed and requested with the primary source.
At the request of users, the data can be archived to not appear.
This allows for the data to remain permanently hidden rather
than re-appearing with a new search after being previously
purged.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Account & Usage
Information

Active Subscriptions:
At Customer’s or user’s
discretion

Users can request to remove their Account Information by
opening a TAC service request. Cisco will respond to such
requests within thirty (30) days.

Deactivated Accounts:
Deleted within thirty (30) days
Directory Data

Active Subscriptions:
At Customer’s or user’s
discretion

Administrators can disable the Active Directory feature whilestill enabling People Insights. Directory data will be harddeleted in this case of deactivation. Non-directory data willremain, with the exception of name and email for users who
had only directory data in their profile before the deactivation.

Deactivated Accounts:
Deleted within thirty (30) days
User-Generated
Information

Active Subscriptions: At
Customer’s or user’s discretion

Users can delete User-Generated Information from their profileat any time.

Deactivated Accounts: Deleted
within thirty (30) days

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
Personal Data Category

Security Controls and Measures

Publicly Available Business &Professional Data
Host & Usage Information

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

Directory Data

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

User-Generated Information

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for the
Feature is below:
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services•

Cloud Storage

United States•••

Publicly Available
Business &Professional Data
Host & Usage
Information
Directory Data
User-Generated
Information©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

Addendum Two: Facial Recognition forWebex Meetings (Optional)
This Addendum describes the processing of personal data (or personal identifiable information) by the Facial
Recognition feature for Webex Meetings. The Facial Recognition feature is only available when using Webex
Meetings on certain Cisco Endpoint devices.
Facial Recognition feature for Webex Meetings is a cloud-based feature solution made available by Cisco tocompanies or persons who acquire it for use by their authorized users.
Cisco will process personal data from Facial Recognition feature for Webex Meetings in a manner that is
consistent with this Privacy Data Sheet. In jurisdictions that distinguish between Data Controllers and Data
Processors, Cisco is the Data Controller for the personal data processed to administer and manage theCustomer relationship. Cisco is the Data Processor for the personal data processed by Webex Meetings toprovide its functionality.

1. Overview

Cisco introduced the facial recognition feature (“Facial Recognition” or the “Feature”) to provide Webex
Meetings users with the ability to identify and recognize registered Webex Meetings participants (i.e., associateparticipant names with their positions in a Webex Meetings video), giving users increased connection tomeeting participants. The Feature recognizes a face by converting it to an abstracted facial vector. A facial
vector is a list of numbers that characterizes salient facial features of a user that is then used to identify who isin the meeting. This level of abstraction allows the system to recognize the same face even when things likelighting and position change.
Facial Recognition is disabled by default, and requires affirmative action by both the Customer and the user toenable. First, the administrator for the Customer may enable Facial Recognition using Webex Control Hub.
However, the feature will not be available on the user’s account until the user opt-ins at
https://settings.webex.com. Because the Feature is based on facial vectors derived from profile images, theuser must have a picture taken at the time of enablement.

2. Personal Data Processing

If the user opts in to the Feature, the Service uses the camera of the user’s device to take a profile picture. This
picture is sent to the Webex cloud where the Feature algorithm generates a facial vector from the picture sothat it can be used for matching as further described below. Both the picture and the facial vector are
encrypted and stored securely. The picture may be used to generate a new facial vector in the event Cisco
updates or modifies the Feature algorithm by which facial vectors are generated. In the event a Customer oruser reaches out to Cisco for support with the Feature, Cisco may also use the picture during thetroubleshooting process. During each Webex Meeting, a second facial vector is generated, which is thenmatched in the Webex cloud against the stored facial vector. This second facial vector is not retained.
The table below lists the personal data processed by Facial Recognition to provide the Feature and describes
why the data is processed.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Personal Data Category

Type of Personal Data

Purpose of Processing

User Information•••

Name (First, Last)
EmailUser ID••

Enroll you in the Feature and enable opt-in
To display name of recognized user

Biometrics••

User facial image
Facial vector mapping•

To create facial vector mapping and provide the
FeatureTo generate a new facial vector in case of amodification or update to the Feature algorithm•

Host & Usage Information•

Information regarding
accuracy of product,
including:oSuccessful andunsuccessful facial
vector matchingoUser feedback•••

To provide support and product analytics
Make improvements to the Feature
Diagnostic and troubleshooting purposes

Location•

Meeting Room Proximity data•

Proximity data is used to improve Facial Recognition
to assure facial vectors are matched to the correctusers in the correct locations

Calendar•Meeting Room Calendar
Information•

Calendar information is used to improve Facial
Recognition to assure facial vectors are matched tothe correct users in the correct locations

3. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:
•
•
•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses
EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework

4. Access Control

The table below lists the personal data used by Facial Recognition to provide the Feature, who can access thatdata, and why.
Personal Data Category

Who has AccessPurpose of the Access

User Information

Cisco

•
•

To display name of recognized user
Enroll you in the Feature and enable opt-in

Customer•

View user facial recognition registration status©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Users throughhttps://settings.webex.com/•

View and modify facial recognition registration details

Biometrics

Cisco

•
•
•

To provide the Feature
Algorithm improvement
To troubleshoot issues in the event Customer or users
request support

Host & Usage Information

Cisco

•

To provide support and product analytics

Location

Cisco•

Proximity data is used to improve Facial Recognition toassure facial vectors are matched to the correct users in
the correct locations

Calendar

Cisco•

Calendar information is used to improve Facial
Recognition to assure facial vectors are matched to thecorrect users in the correct locations

5. Data Portability

While Webex Meetings allows Customers and users to export data as described in Section 7 of the Webex
Meetings Privacy Data Sheet, it does not support the automatic export of Facial Recognition data.

6. Data Retention

The table below lists the personal data used by Facial Recognition, the length of time that data needs to beretained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

User ID is maintained for all active
Webex Meetings users. Once a user
is deleted from a Customer’s
account, the User ID is also deleted
from the Feature.

User ID is used to track your enrollment in the Feature.

Biometrics

All other User Information is notstored or retained by the Feature as
this information is already stored byWebex Meetings.
Images: Users control their image
retention. The image is retained aslong as the Feature is enabled andthe user leaves the image associatedwith their profile. The image can bedeleted at any time by the user.
Images for all users are deleted upon
Customer’s discontinuation of theService.
Facial vectors are retained as long as
the facial images, but are stored
separately.

Names are displayed upon a match in the Feature.

The image is used to provide the Feature, update the facial
vector in case of an update to the Facial Recognition
algorithm, and to troubleshoot issues when requested by a
Customer or user.

The facial vectors are used to provide the Feature.

Facial vectors are deleted upon
discontinuation of the Service.
Host & Usage Information

2 weeks©2024 Cisco and/or its affiliates. All rights reserved.

To provide support and product analytics.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Location

2 days

Proximity data is used to improve Facial Recognition toassure images are assigned to the correct users in thecorrect locations.

Calendar

Facial Recognition does not store or
retain this information separately
than already maintained by Webex
Meetings.

7. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for the Feature.
Personal Data Category

Security Controls and Measures

User Information

Encrypted in transit, AES 256 for storage

ImagesEncrypted in transit, AES 256 for storage

Biometrics

Encrypted in transit, AES 256 for storage

Host & Usage Information

Encrypted in transit, AES 256 for storage

Location

Encrypted in transit, AES 256 for storage©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Three: Closed Captioning
for Webex Meetings (Optional)
This Addendum describes the processing of personal data (or personal identifiable information) by the Closed
Captioning feature for Webex Meetings (“Closed Captioning” or the “Feature”).
Cisco will process personal data from Closed Captioning in a manner that is consistent with this Privacy Data
Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is the Data
Controller for the personal data processed to administer and manage the Customer relationship. Cisco is theData Processor for the personal data processed by Cisco Webex Meetings to provide its functionality.

1. Overview

To make your Webex Meetings and Webex Webinars more accessible, Webex provides automated closed
captioning which you can turn on without needing to turn on Webex Assistant for Webex Meetings. As people
speak, closed captioning will appear above the Webex Meetings or Webex Webinar controls. A closed captions
panel is also available, which shows users the closed captions from the moment they joined the Webex
Meeting, so they can easily catch up if they miss anything that’s being said.
Closed Captioning is a cloud-based feature that is enabled “ON” by default; Customer administrators canselect enablement for specific users or, if a Customer administrator intends to disable for all users, he or she
can request that Cisco disable at an organization level. Users can also disable Closed Captioning, so that
captions do not appear for themselves; however, if other users in their Webex Meeting(s) have Closed
Captioning ON, data belonging to users who have disabled the functionality will still be processed inaccordance with the privacy disclosures below.
If a host turns on Webex Assistant for Webex Meetings in addition to Closed Captioning, then they will haveadditional capabilities to make voice commands and highlight captions to capture audio snippet notes, asdetailed in Addendum Four. Additionally, hosts can record the Webex Meeting and receive a post-meetingtranscript, which they can choose to share with other Webex Meetings users.
Customer administrators can also enable or disable the Captions & Highlights panel for their site.

2. Personal Data Processing

The table below lists the personal data processed by Closed Captioning to provide the Feature and describes
why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

Audio Information•

Audio captured during
meeting••

Provide Closed Captioning
When you utilize the real-time translation andtranscription feature in multiple languages, data may
be used for product improvement. You may opt out of
this use by submitting a request here.

Transcript Information••

Webex Meetings Transcript
Text of real-time speech fortranslations••

Provide Closed Captioning
When you utilize the real-time translation andtranscription feature in multiple languages, data may©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

be used for product improvement. You may opt out of
this use by submitting a request here.
Host and Usage
Information•

Usage of Closed Captioning,
including number of Webex
Meetings with Closed
Captioning enabled, andtroubleshooting events

•
•
•
•
•

Provide Closed Captioning
Provide Customer with usage information
Diagnose technical issues
Improve the technical performance of the Service
Understand how Closed Captioning is used

3. Data Center Locations

Closed Captioning data center locations track the data center locations for Webex Assistant for Webex
Meetings, which are outlined in Addendum Four below. Please refer to Addendum Four below.

4. Cross-Border Data Transfer Mechanisms

Closed Captioning cross-border data transfer mechanisms are the same as those listed for Webex Assistant forWebex Meetings, which are outlined in Addendum Four below. Please refer to Addendum Four below.

5. Access Control

The table below lists the personal data used by Closed Captioning, who can access that data, and why.
Personal Data Category

Who has AccessPurpose of the Access

User Information

Cisco

Enroll users in Closed Captioning.

Customer

Enable/disable Closed Captioning for specific Webex
Meetings users or an entire site.

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls process.

Customer

Customer will continue to have access to Meetings
Recordings (if the meeting was recorded by host) inaccordance with Customer’s personal data policy and as
described in the Webex Meetings Privacy Data Sheet.

User

No highlights or meeting audio information is retained after
the meeting when Close Captioning only is used during thelive meeting

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls.

User

By default, no transcript is retained when Closed Captioning
only is used during the live Webex Meeting unless recording
was enabled.
If recording was enabled, a transcript will be available in therecording page and review tab in the post meeting
experience, a meeting host will be able to view, accessand/or share transcript Information. A host may share andgive certain edit permissions to other Webex Meetings users.

Audio Information

Transcript Information©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Host and Usage
Information

Cisco

Support and improve the Service in accordance with Cisco’s
data access and security controls.

Customer

View and analyze usage information.

6. Data Portability•••

Webex Meetings hosts and users with edit privileges to a given meeting can download the meetingtranscript in txt or vtt formats.
Webex Meetings hosts and users with edit privileges to a given meeting can email highlights to aselected email account.
Webex Meetings hosts and users with edit privileges to a given meeting can share a meeting in anexisting or a newly created Webex space.

7. Data Retention

Subject only to their employer’s corporate retention policies, users with an active subscription have control overtheir Audio and Transcript Information and can delete such information from their account through the My
Webex Page as described below. If you have any questions regarding deletion or deletion requests, pleasecontact Cisco through the Cisco Privacy Request Form.
The table below lists the personal data used by Closed Captioning, the length of time that data needs to beretained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

User Information is not separately
stored or retained as part ofClosed Captioning, as thisinformation is already stored byWebex Meetings.

Audio Information

Active Subscriptions: Audio
Information deleted atCustomer’s or user’s discretion.

Audio Information is retained to provide you with the Service
and will be deleted once it is no longer necessary to provide
the Service.

Terminated Service: Deleted
within 60 days

Audio Information retained after the Service is terminated isdone to make it available to Customers for download.
Audio Information related to real-time translation andtranscription in multiple languages is retained for 2 years for
product improvement. You may opt out of this use bysubmitting a request here.

Transcript Information

Active Subscriptions: Highlights
may be deleted at Customer’s oruser’s discretion.

Transcript Information is retained to provide you with theService and will be deleted once it is no longer necessary toprovide the Service.

Terminated Service: Deleted
within 60 days

Transcript Information retained after the Service is terminated isdone to make it available to Customers for download.
Transcription Information related to real-time translation andtranscription in multiple languages is retained for 2 years for
product improvement. You may opt out of this use bysubmitting a request here.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public
Host and Usage

Privacy Data Sheet

Deleted after 3 years.

©2024 Cisco and/or its affiliates. All rights reserved.

Usage information used to conduct analytics and measurestatistical performance is retained but pseudonymized.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes the encryption architecture of data stored specifically for Closed Captioning.
Personal Data Category

Security Controls and Measures

User Information

Closed Captioning does not store or retain this information separately than the information
already maintained by Webex Meetings.

Audio Information

Encrypted in transit. Closed Captioning is not stored at rest.

Transcript Information

Encrypted in transit. Closed Captioning is not stored at rest.

Host and Usage

Encrypted in transit and at rest.

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for Closed
Captioning is below:
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services

Audio Information

Cloud Infrastructure (transient storage only)

US, Singapore,
France, Japan,
Ireland, Sweden

GoogleAudio and transcript ofVoice Command only (e.g.,“OK, Webex, create anote”).

• Speech-to-Text service (voice commands
only)• Text-to-Speech service (voice command
responses only)

US, Germany,
Singapore,
Netherlands,
Belgium, Japan

Provide translation and/or foreign languagetranscription using text of real-time speech.

Globally

Please note that the coretranscription technologythat processes and stores
all other Audio andTranscript Information is
owned, managed andexecuted by Cisco.
Google*Transcript Information

Google may process but not store transcript
Information to provide speech-to-text services

Audio Information (except
if spoken language chosen

Transcript data is processed by Google atglobal endpoints, except when a Customer isprovisioned in the European Union (EU). For EU
Customers, transcript data processed by
Google is processed within region as part ofWebex Data Residency.
When you add-on and use the real-timetranslation and transcription feature in multiple©2024 Cisco and/or its affiliates. All rights reserved.

For EU Customers,
within the EU

Globally

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet

is English, French, German,
Italian, Spanish)

Azure*

Transcript Information

languages, Google may process but not store
Audio Information to provide speech-to-text
services.
Audio data is processed by Google at global
endpoints, except when a Customer isprovisioned in the EU. For EU Customers,
audio data processed by Google is processed
within region as part of Webex Data
Residency.
Provide translation and/or foreign languagetranscription using text of real-time speech.

For EU Customers,
within the EU

Globally

Azure may process but not store transcript
Information to provide speech-to-text services

Audio Information (except
if spoken language chosen
is English, French, German,
Italian, Spanish)

Transcript data is processed by Azure at global
endpoints, except when a Customer isprovisioned in the European Union (EU). For EU
Customers, transcript data processed by Azureis processed within region as part of Webex
Data Residency.
When you add-on and use the real-timetranslation and transcription feature in multiple
languages, Azure may process but not store
Audio Information to provide speech-to-text
services.
Audio data is processed by Azure at global
endpoints, except when a Customer isprovisioned in the EU. For EU Customers,
audio data processed by Azure is processed
within region as part of Webex Data
Residency.

For EU Customers,
within the EU

Globally

For EU Customers,
within the EU* These sub-processors will only apply to You if You have purchased and are using real-time translation andtranscription in multiple languages.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Four: Webex Assistant for
Meetings (Optional)
This Addendum describes the processing of personal data (or personal identifiable information) by Webex
Assistant for Webex Meetings (“Webex Assistant”) feature for Webex Meetings.
Webex Assistant is a cloud-based feature made available by Cisco to companies or persons who acquire it for
use by their authorized users. Webex Assistant provides additional functionality to Closed Captioning, forexample, allowing users to use voice commands, highlight closed captions during the meeting, and edit orshare highlights after a meeting.
Cisco will process personal data from Webex Assistant in a manner that is consistent with this Privacy Data
Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is the Data
Controller for the personal data processed to administer and manage the Customer relationship. Cisco is theData Processor for the personal data processed by Webex Meetings in order to provide its functionality.

1. Overview

Webex Assistant is an intelligent, interactive virtual meeting assistant that makes meetings searchable,
actionable, and more productive. When Webex Assistant is turned on, the meeting host and participants cancapture meeting highlights with one click or through a voice command. Even when Webex Assistant joins a
Webex Meeting, it will only be activated by the wake word, “OK Webex.” Once the wake word is detected, thevoice command is streamed to the cloud for speech-to-text transcription and processing. Any participant canuse one of many voice commands and create a meeting highlight. Meeting highlights can include meeting key
points, notes, summaries, agendas, action items or decisions.
Webex Customer administrators can enable or disable Webex Assistant for a Webex site and can restrict use of
Webex Assistant to certain users or groups of users at any time.
Cisco has put several controls in place to ensure user transparency. When Webex Assistant is enabled, theWebex Assistant icon appears in the lower left of the host and participant’s screen. On Webex endpoint
devices, there will be a visual cue similar to the existing one you see when a Webex Meeting is recorded.
Additionally, when the host turns on Webex Assistant in a Webex Meeting, there will be an audio
announcement made to all participants on the call, even if they join late (unless the Webex Customer
administrator has disabled the announcement). As further described below, the host can choose to share thetranscript and meeting highlights with other Webex Meetings users.

2. Personal Data Processing

The table below lists the personal data processed by Webex Assistant to provide its services and describes
why the data is processed.
Personal Data Category

Type of Personal Data

User Information

•
•
•
•

Name (First, Last)
Email
Username
Unique User Identifier (UUID)©2024 Cisco and/or its affiliates. All rights reserved.

Purpose of Processing••

Enable Webex Assistant for specific Webex
Meetings users or for an entire site
Provide Webex AssistantVersion 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Audio Information•••

Webex Meetings Recordings
Audio Commands to Webex
Assistant
Audio captured during
meeting••

Provide Webex Assistant
When you utilize the real-time translation andtranscription feature in multiple languages, data may
be used for product improvement. You may opt out of
this use by submitting a request here.

Transcript Information•••

Webex Meetings Transcript
Text of meeting Highlight
Text of real-time speech fortranslations••

Provide Webex Assistant
When you utilize the real-time translation andtranscription feature in multiple languages, data may
be used for product improvement. You may opt out of
this use by submitting a request here.

Host and Usage
Information•

Usage of the Webex Assistantfeatures, including number of
meetings with Webex
Assistant enabled,
number/type of Highlightviews/edits/downloads,
troubleshooting events

•
•
•
•
•

Provide Webex Assistant
Provide Customer with usage information
Improve the technical performance of the Service
Diagnose technical issues
Understand how Webex Assistant is used

3. Data Center Locations

Cisco leverages its own data centers as well as third-party hosting providers and business partners to deliver
the Service, including Webex Assistant, globally.
Webex Assistant Audio and Transcript Information will be stored in the same location in which the Customer isprovisioned for Webex Meetings recordings. Although Webex Assistant may process data in AWS as listed in
Section 9 below, no data will be stored there.

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:
•
•
•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses
EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework

5. Access Control

The table below lists the personal data used by Webex Assistant, who can access that data, and why.
Personal Data Category

Who has AccessPurpose of the Access

User Information

Cisco

Enroll users with Webex Assistant.

Customer

Enable Webex Assistant for specific Webex Meetings users orfor an entire site.

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls process.

Audio Information©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Transcript Information

Host and Usage
Information

Customer

Customer will continue to have access to Meetings
Recordings in accordance with Customer’s personal data
policy and as described in the Webex Meetings Privacy Data
Sheet.

User

A meeting host will be able to view, access and/or delete
highlights. A host may share and give certain edit permissions
to other Webex Meetings users.

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls.

User

A meeting host will be able to view, access and/or sharetranscript information. A host may share and give certain edit
permissions to other Webex Meetings users.

Cisco

Support and improve the Service in accordance with Cisco’s
data access and security controls.

Customer

View and analyze usage information.

6. Data Portability

Users have the option to email any transcript or highlight to a selected email account.

7. Data Retention

Subject only to their employer’s corporate retention policies, users with an active subscription have control overtheir Audio and Transcript Information and can delete such information from their account through the My
Webex Page as described below. If you have any questions regarding deletion or deletion requests, pleasecontact Cisco through the Cisco Privacy Request Form.
The table below lists the personal data used by Webex Assistant, the length of time that data needs to beretained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

User Information is not separately
stored or retained by Webex
Assistant as this information isalready stored by Webex
Meetings.

Audio Information

Active Subscriptions: Audio
Information deleted atCustomer’s or user’s discretion.

Audio Information is retained in order to provide you with theService and will be deleted once it is no longer necessary toprovide the Service.

Terminated Service: Deleted
within 60 days

Audio Information retained after the Service is terminated isdone in order to make it available to Customers for download.
Audio Information related to real-time translation andtranscription in multiple languages is retained for 2 years for
product improvement. You may opt out of this use bysubmitting a request here.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Transcript Information

Active Subscriptions: Highlights
may be deleted at Customer’s oruser’s discretion.

Transcript Information is retained in order to provide you with
the Service and will be deleted once it is no longer necessary
to provide the Service.

Terminated Service: Deleted
within 60 days

Transcript Information retained after the Service is terminatedis done in order to make it available to Customers fordownload.

Transcription Information related to real-time translation andtranscription in multiple languages is retained for 2 years for
product improvement. You may opt out of this use bysubmitting a request here.

Host and Usage

Deleted after 3 years.

Usage information is used to conduct analytics and measurestatistical performance.

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for Webex Assistant.
Personal Data Category

Security Controls and Measures

User Information

Webex Assistant does not store or retain this information separately than the information
already maintained by Webex Meetings.

Audio Information

Encrypted in transit and at rest.

Transcript Information

Encrypted in transit and at rest.

Host and Usage

Encrypted in transit and at rest.

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for Webex
Assistant is below:
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services

Audio Information

Cloud Infrastructure (transient storage only)

US, Singapore,
France, Japan,
Ireland, Sweden

GoogleAudio and transcript ofVoice Command only (e.g.,• Speech to Text service (voice commands
only)

US, Germany,
Singapore,©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Doc type
Cisco public

Privacy Data Sheet“OK, Webex, create anote”).

• Text to Speech service (voice command
responses only)

Netherlands,
Belgium, Japan

Provide translation using text of real-time
speech.

Globally

Transcript data is processed by Google atglobal endpoints, except when a Customer isprovisioned in the European Union (EU). For EU
Customers, transcript data processed by
Google is processed within region as part ofWebex Data Residency.
When you add-on and use the real-timetranslation and transcription feature in multiple
languages, Google may process but not store
Audio Information to provide speech-to-text
services

For EU Customers,
within the EU

Please note that the coretranscription technologythat processes and stores
all other Audio andTranscript Information is
owned, managed andexecuted by Cisco.
Google*Transcript Information

Audio Information (except
if spoken language chosen
is English, French, German,
Italian, Spanish)

Audio data is processed by Google at global
endpoints, except when a Customer isprovisioned in the EU. For EU Customers,
audio data processed by Google is processed
within region as part of Webex Data
Residency.
Azure*

Transcript Information

Audio Information (except
if spoken language chosen
is English. French, German,
Italian, Spanish)

Globally

For EU Customers,
within the EU

Provide translation using text of real-time
speech.

Globally

Transcript data is processed by Azure at global
endpoints, except when a Customer isprovisioned in the European Union (EU). For EU
Customers, transcript data processed by Azureis processed within region as part of Webex
Data Residency.
When you add-on and use the real-timetranslation and transcription feature in multiple
languages, Azure may process but not store
Audio Information to provide speech-to-text
services.

For EU Customers,
within the EU

Audio data is processed by Azure at global
endpoints, except when a Customer isprovisioned in the EU. For EU Customers,
audio data processed by Azure is processed
within region as part of Webex Data
Residency.

Globally

For EU Customers,
with the EU* These sub-processors will only apply to you if you have purchased and are using real-time translation andtranscription in multiple languages.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Five: Webex Assistant for
DevicesThis Addendum describes the processing of personal data (or personal identifiable information) by Webex
Assistant for Devices.
Webex Assistant for Devices is a cloud-based feature made available by Cisco to companies or persons who
acquire it for use by their authorized users.
Cisco will process personal data from Webex Assistant for Devices in a manner that is consistent with thisPrivacy Data Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is theData Controller for the personal data processed to administer and manage the Customer relationship. Cisco is
the Data Processor for the personal data processed by Cisco Webex Meetings in order to provide its
functionality.

1. Overview

Webex Assistant for Devices gives you a new way to control your devices by using voice commands. Throughvoice commands, a user is able to join meetings, control meeting settings and more. Webex Assistant for
Devices is disabled by default and can be enabled by the Customer’s administrator in Webex Control Hub.
Webex Assistant for Devices is activated by the wake word, “OK Webex.” Once the wake word is detected,
speech is streamed to the cloud for speech-to-text transcription. As wake word processing is local on thedevice, no audio data is stored, processed or streamed to the cloud until the wake word is detected. After thewake word and command are processed, the resulting text from the speech engine is returned to the Webex
Assistant client on the endpoint device and displayed to the user. Although Webex Assistant for Devices
securely manages functional interactions with Google Speech Services to enable the service, data is not storedor further processed by Google for any other purpose than to provide you with the service.

2. Personal Data Processing

The table below lists the personal data processed by Webex Assistant for Devices to provide its services anddescribes why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information•

Synched Corporate Directory
information (e.g., name, email,title)For users who pair with Cisco
endpoint device:oUnique User IdentifieroFirst Nameo
Display name••

Provide Webex Assistant
Improve Webex Assistant’s accuracy to user’scommandUser audio commands•

Provide Webex Assistant

•

Audio

•

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Transcripts

•

•

Usage

•

Text of command

Webex Assistant usage
information (e.g., number ofqueries from endpoint
devices, dates)
Endpoint devices used•••

Provide Webex Assistant••Diagnose technical issues
Improve the technical performance of Webex
Assistant
Understand how Webex Assistant is used•

Train and/or improve Cisco language services

3. Data Center Locations

Cisco leverages its own data centers as well as third-party hosting providers and business partners to deliver
Webex Assistant for Devices globally. These entities are currently located in the following locations (data center
locations may change from time to time and this Privacy Data Sheet will be updated to reflect those changes):
Data Center Locations
Germany
United States
Singapore

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:
•
•
•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses
EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework

5. Access Control

The table below lists the personal data used by Webex Assistant for Devices, who can access that data, andwhy.
Personal Data Category

Who has AccessPurpose of the Access

User Information

Cisco

Enable, support and improve Webex Assistant in accordancewith Cisco’s data access and security controls process.

Audio

Cisco

Provide Webex Assistant.

Transcripts

Cisco

Support, train and improve Webex Assistant. Understand how
the product is being used.

Usage Information

Cisco

Support and improve the Service in accordance with Cisco’s
data access and security controls process. Understand how
the product is being used.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Customer

View and analyze some usage information on Control Hub.

6. Data Portability

While Webex Meetings allows Customers and users to export data as described in Section 7 of the Webex
Meetings Privacy Data Sheet, it does not support the export of Webex Assistant for Devices data.

7. Data Retention

The table below lists the personal data used by Webex Assistant for Devices, the length of time that data needs
to be retained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

Stored while Customer isenrolled in Webex Assistant for
Devices.

User Information is retained in order to provide you with theService and will be deleted once it is no longer necessary toprovide the Service.

After Customer disables Webex
Assistant, User Information isdeleted within a week.
If you have paired with a device,
the relevant data is retained for 1
year.
Audio

Not retained

N/ATranscript

1 yearTranscripts are retained to evaluate and improve Webex
Assistant and understand how the product is being used. Text
transcripts (e.g., “OK Webex, Start a Meeting”) will be deidentified and may be stored indefinitely.

Usage

Deleted within 2 years

Usage is retained to evaluate the service and understand how
Webex Assistant is being used.

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for the Webex Assistant for
Devices.
Personal Data Category

Security Controls and Measures

User Information

Encrypted in transit, encrypted at rest

Audio

Encrypted in transit, encryption at rest is not applicable3

Transcript

Encrypted in transit, encrypted at rest

Usage

Encrypted in transit, encrypted at rest

3 The Webex platform and Google Cloud do not store audio; therefore, encryption at rest is not available for audio.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

9. Sub-processors
Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for
Assistant for Devices is below:
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services

Transcript

AWS cloud infrastructure is used to hostWebex Assistant for Devices applications inGermany, Singapore, and the US.

United States
Singapore
Germany

Transcripts routed to and processed in the EU(Frankfurt data center) are not stored. All othertranscripts generated are stored in theirclosest region of storage (Singapore or theUS).

Google Cloud
Google Cloud
SplunkAudio• Transcript• Usage• Transcript• Usage

Speech to text service
Cloud storage region

Worldwide
United States

Data analysis platform

United States©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Six: Slido in Webex (Optional)

This Addendum to the Webex Meetings Privacy Data Sheet describes the processing of personal data (orpersonally identifiable information) by the Slido feature in Webex Meetings (“Slido” “Slido in Webex,” or the“Service”).

1. Overview of Slido in Webex Meetings Capabilities

Slido in Webex is a cloud-based polling and Q&A solution aimed at B2B customers. Users stay engaged during
meetings by voting in live polls and asking questions. Slido is an integrated part of Webex Meetings or available
to hosts and meeting participants as a web application. For a detailed overview of the Service, please visit the
Slido in Webex website.

2. Personal Data Processing

The table below lists the personal data processed by Slido in Webex to provide the Service and describes why
the data is processed.
Because of the nature of the Service, we do not expect any sensitive data to be sent through Slido.
Personal Data Category

Type of Personal Data

Purpose of Processing

Host Information•••

Name, email address, organization ID•

Provide you with the Service
Respond to Customer support
requests
Conduct analytics and statisticalanalysis in aggregate form to improve
the technical performance of the Service

Participant Information•

Name, email address, organization ID•

Provide you with the Service

User-Generated Information•

Questions, answers, ideas, chats - any
content shared or created by participants•

Provide you with the Service

User Technical Information•

Device data (e.g. hardware model,
operating system version, unique device
identifiers),
Log data (e.g., your search queries, details
about your connection such as IP address,
date, time, edge-location, ssl-protocol, sslcipher or time-taken to serve you requested
site, device event information such as
crashes, system activity, hardware settings,
browser type, browser language, the date
and time of your request and referral URL)
Location information (IP address)
Unique users IDs
Browser local storage and application data
caches••Provide you with the Service
Conduct analytics and statisticalanalysis in aggregate form to improve thetechnical performance of the Service

•

•
•
•

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
Cookies•Essential cookies collected throughembedded browser utilized in the WebexSlido interface••

Provide you with the Service
Conduct analytics and statisticalanalysis in aggregate form to improve
the technical performance of the Service

Support Information

We collect contact data of people reaching out
through Slido.com for support:

•
•

•

•

Provide you with the Service
Respond to Customer support
requests
Conduct analytics and statistical analysis inaggregate form to improve the technicalperformance of the Service

Usually name, email, company

Technical Support Assistance

If a Customer reaches out to Cisco Technical Assistance Center (TAC) for problem diagnosis and resolution,
Cisco TAC may receive and process personal data from the Service. The Cisco TAC Service Delivery Privacy
Data Sheet describes Cisco’s processing of such data.

3. Data Center Locations

Cisco uses third-party infrastructure providers to deliver the service globally. Please see Section 9 for a list of
sub-processors, including infrastructure providers.
Data center location is determined as follows:
1.
2.

3.

EU data centers are used for Customers by default.
For countries where Slido data centers are available at the time the Customer becomes a Slido
Customer, data center location is determined based on the location of the Customer’s User
Information.
Slido data centers in USA are generally available as of June 2023; in Canada as of May 2023.

Data Center Locations
Ireland (back-up in Germany)
Virginia, USA (back-up in Oregon, USA)
Quebec, Canada (back-up in Alberta, Canada)

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:
•
•
•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses
EU-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework
Swiss-U.S. Data Privacy Framework©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

5. Access Control

The table below lists the personal data used by Slido to carry out the service, who can access that data, andwhy. Content you choose to share during an event may be accessed by users in the event, wherever they arelocated. Even after you remove information from the Service, copies of that content may remain viewableelsewhere to the extent it has been shared with others.
Personal Data Category

Who has AccessPurpose of the Access

Host Information

Host

View host profile data through slido.com

CustomerManage, delete user’s slido profiles through slido.com

Cisco

Provide the Service

Host

View joined participants through slido.com

Cisco

Support the Service in accordance with Cisco’s data
access and security controls

Customer

Delete participant content data by submitting privacy
request form

Host

View submitted User-Generated Information throughslido.com

Cisco

Support the Service in accordance with Cisco’s data
access and security controls.

Participant Information

User-Generated
Information

Cisco will not access this data unless authorization is
granted by the Customer, and will only access it inaccordance with Cisco’s data access and security controls.
User Technical Information

Cisco

Provide, tailor and improve the Service

Cookies

Cisco

Provide, tailor and improve the Service

Support Information

Cisco

Support Information is kept as part of record of service
delivery

6. Data Portability

Slido allows Customers and hosts to export event content data through slido.com.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

7. Data Retention

The table below lists the personal data used by Slido, the length of time that data needs to be retained, andwhy we retain it.
Type of Personal Data

Retention Period

Reason for Retention

Host Information

Host Information is retained
until account termination.

•

Provide the Service

Participant Information

Participant Information
associated with a specificmeeting is retained until
account termination.

•

Provide the Service•

Provide the Service•

Technical Information is kept as part of Cisco’s record ofservice delivery, conduct analytics and measure statistical
performance.

User-Generated
Information

Technical Information

Participant Information
associated with a specificmeeting can be deleted bydeleting all Slido dataassociated with that meeting.
As request must be submitted
through a privacy request.
User-Generated Information
associated with a specificmeeting is retained until
account termination.
User-Generated Information
associated with a specificmeeting can be deleted bydeleting all Slido dataassociated with that meeting.
As request must be submitted
through a privacy request.
Deleted 180 days aftercollection

Cookies

Maximum of one year•

To provide, tailor and improve the Service

Support Information

Not deleted•

Support Information is kept as part of record of service
delivery

Terminating your Webex Meetings account does not automatically terminate your Slido account as well. If you
wish to terminate your Slido account first, you can do this yourself using the controls within your Slido userinterface. If you have already terminated your Webex Meetings account and would also wish to terminate yourSlido account, please reach out to our support team via support@slido.com.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

8. Personal Data Security

Slido has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
Personal Data Category

Security Controls and Measures

Host Information

Encrypted in transit and at rest

Participant Information

Encrypted in transit and at rest

User-Generated Information

Encrypted in transit and at rest

User Technical Information

Encrypted in transit and at rest

Cookies

Encrypted in transit and at rest

Support Form Information

Encrypted in transit

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for theservice is below.
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services• Host Information• Participant Information• User-Generated
Information• User Technical
Information• Cookies• Support Information

Infrastructure as a Service

Dublin, IrelandFrankfurt, Germany
Virginia, USA
Oregon, USA
Quebec, Canada
Alberta, Canada

10. Information Security Incident Management
Breach and Incident Notification Processes

The Information Security team within Cisco’s Security & Trust Organization coordinates the Data Incident
Response Process and manages the enterprise-wide response to data-centric incidents. The Incident
Commander directs and coordinates Cisco’s response, leveraging diverse teams including the Cisco Product
Security Incident Response Team (PSIRT), the Cisco Security Incident Response Team (CSIRT), the Advanced
Security Initiatives Group (ASIG), and Cisco Legal.
PSIRT manages the receipt, investigation, and public reporting of security vulnerabilities related to Cisco
products and networks. The team works with Customers, independent security researchers, consultants,
industry organizations, and other vendors to identify possible security issues with Cisco products and networks.
The Cisco Security Center details the process for reporting security incidents.
The Cisco Notification Service allows Customers to subscribe and receive important Cisco product andtechnology information, including Cisco security advisories for critical and high severity security vulnerabilities.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco publicThis service allows Customers to choose the timing of notifications, and the notification delivery method (email
message or RSS feed). The level of access is determined by the subscriber's relationship with Cisco. If you
have questions or concerns about any product or security notifications, contact your Cisco sales representative.

11. Certifications and Compliance with Privacy Requirements

The Security & Trust Organization and Cisco Legal provide risk and compliance management and consultation
services to help drive security and regulatory compliance into the design of Cisco products and services. The
Service is built with security and privacy in mind and is designed so that it can be used by Cisco customers in amanner consistent with global security and privacy requirements, including the Health Insurance Portability andAccountability Act (HIPAA).
Further, in addition to complying with our stringent internal standards, Slido also maintains third-party
validations and certifications to demonstrate our commitment to information security and privacy. The Service
has received the following certifications:•••

ISO/IEC 27001:2013, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019
Certification
SOC 2 Type II Report
HIPAA self assessment

As part of its integration, Slido intends to pursue other privacy certifications, including those associated with
Webex.

12. Exercising Data Subject Rights

Users whose personal data is processed by the Service have the right to request access, rectification,suspension of processing, data portability and / or deletion of the personal data processed by the Service aswell as object to processing.
We will confirm identification (typically with the email address associated with a Cisco account) before
responding to the request. If we cannot comply with the request, we will provide an explanation. Please note,users whose employer is the Customer/Controller, may be redirected to their employer for a response.
Requests can be made by submitting a request via:
1) the Cisco Privacy Request form
2) by postal mail:Chief Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAmericas Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134

APJC Privacy Officer
Cisco Systems (USA) Pte Ltd
Bldg 80, Lvl 25, Mapletree Biz
City,©2024 Cisco and/or its affiliates. All rights reserved.

EMEA Privacy Officer
Cisco Systems, Inc.
Haarlerbergweg 13-19, 1101 CH
Amsterdam-Zuidoost

Version 12.0, September 16, 2024

Doc type
Cisco public
UNITED STATES

Privacy Data Sheet

80 Pasir Panjang Road,
Singapore, 117372
SINGAPORE

NETHERLANDS

We will endeavor to timely and satisfactorily respond to inquiries and requests. If a privacy concern related tothe personal data processed or transferred by Cisco remains unresolved, contact Cisco’s US-based third-party
dispute resolution provider. Alternatively, you can contact the data protection supervisory authority in yourjurisdiction for assistance. Cisco’s main establishment in the EU is in the Netherlands. As such, our EU leadauthority is the Dutch Autoritiet Persoonsgegevens.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Seven: Cisco-Developed
Embedded Apps (Optional)
This Addendum to the Webex Meetings Privacy Data Sheet describes the processing of personal data (orpersonally identifiable information) by Cisco-developed embedded apps in Webex Meetings. Embedded apps
developed by third parties, as stated in the Webex Meetings Privacy Data Sheet, are governed by the respective
third party’s privacy policies.

Shared Timer

1. Overview

Shared Timer (the “Service”) is a cloud-based application that allows meeting hosts and participants to set atimer, using preset intervals, during a particular meeting. The countdown timer is displayed with other meeting
participants.
Personal data processing for Shared Timer is largely covered by the disclosed personal data processing
associated with the Webex Meetings Service; for that, please refer to the Webex Meetings Privacy Data Sheetabove.
A Customer administrator controls whether user-level personal data can be shared with Shared Timer. In
Webex Control Hub, the Customer administrator can set enable or disable personally identifiable information(“PII”) sharing through “PII Restrictions.” “PII Restrictions” are disabled by default (i.e., without any action by
the Customer administrator) and the only pseudonymized user-level personal data will be processed by Shared
Timer, as described below.
The following information is supplementary privacy data information associated specifically with Shared Timer.

2. Personal Data Processing

The table below lists the personal data processed by Shared Timer to provide the Service and describes why thedata is processed.
If PII Restrictions are enabled, PII sharing mode is on, and the following applies:
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information

•
•

•

UUID
Display Name•

©2024 Cisco and/or its affiliates. All rights reserved.

UUID is used to identify which user within
the meeting performed specific activities(e.g., who paused the timer);
Display Name is used to identify the userspecific activities (to display that a certain
individual set or reset the timer)

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
•
•
•
•
•

Host and Usage Information*

•
•
•
•

IP Address
User Agent
Browser
Operating System
Device Type••

Provide you with the Service
Diagnose technical issues
Respond to Customer support requests
Make improvements to the Service andother Cisco products and services
Understand how the Service is used
Conduct analytics and statistical analysis inaggregate form to improve the technicalperformance of the Service

To the extent personal data is shared with sub-processors, it is encrypted at transit. Sub-processors do nothave access to the data in the raw.
If the PII Restrictions are disabled, PII sharing is off, and the following applies:
Personal Data Category

Type of Personal Data

Purpose of Processing

User Level••

Personal data that is collected (e.g., UUID
and Display Name) is pseudonymized

•

•
•
•
•
•

Host and Usage Information*

•
•
•
•

IP Address
User Agent
Browser
Operating System
Device Type••UUID used to identify which user within
the meeting performed specificactivities (e.g., who paused the timer);
Name is processed to identify the userspecific activities (to display that acertain individual set or reset the timer)

Provide you with the Service
Diagnose technical issues
Respond to Customer support requests
Make improvements to the Service andother Cisco products and services
Understand how the Service is used
Conduct analytics and statisticalanalysis in aggregate form to improve
the technical performance of theService

3. Sub-processors

Shared Timer does not use the sub-processors listed in the Webex Meetings Privacy Data Sheet. Shared Timeruses only the following third-party sub-processor.

***

Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services•••

United States

UUID**
Display Name**

Used to provide Shared Timerfunctionality

Collected through use of Webex Meetings processed in connection with Shared Timer.
When PII sharing mode is ON. When PII sharing mode if OFF, data is pseudonymized.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public

Addendum Eight: Webex LTI and Webex
LTI Legacy (Optional)
1. Overview

Webex Meetings and Webex App and Messaging can be used with certain learning management systems(“LMSs”) that support the learning tools interoperability standard (“LTI”). Webex LTI and Webex LTI Legacy(collectively the “Service”) are cloud-based applications that utilize the LTI standard to integrate Webex Meetings
and/or the Webex App and Messaging with LMSs. Webex LTI utilizes LTI 1.3 and LTI Advantage to integrate with
LMSs. Webex LTI Legacy utilizes LTI 1.1 and certain LMS-specific APIs to integrate with LMSs. Previous
installations of Webex Education Connector have been migrated to Webex LTI Legacy.
This Addendum to the Webex Meetings Privacy Data Sheet describes the processing of personal data (orpersonal identifiable information) by the Service when used together with Webex Meetings. If you use theService together with Webex App and Messaging, see the Webex App Privacy Data Sheet (available on The
Cisco Trust Center) for descriptions of the data that may be collected and processed in connection with thoseservices.

2. Personal Data Processing

The table below lists the personal data processed by Webex LTI and Webex LTI Legacy to provide the Service
and describes why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information

•
•
•
•
•
•
•

Name
Email Address
Course Enrollment
Course Role
Browser
Unique User ID (UUID)
Webex Team and Space
membership

•
•
•
•

IP Address
User Agent Identifier
Hardware TypeOperating System Type andVersion
Client Version
IP Addresses Along the Network
Path MAC Address of Your Client(as applicable)
Service Version
Actions Taken
Geographic Region (i.e., Country
Code)
Meeting Session Information (e.g.,
date and time, frequency, average
and actual duration, quantity,
quality, network activity, andnetwork connectivity)

•
•
•
•

Host and Usage Information

•
•
•
•
•
•

•
•
•
•

©2024 Cisco and/or its affiliates. All rights reserved.

•
•

•
•

Provide you with the Service
Enroll you in the Service
Respond to Customer support requests
Authenticate and authorize access toyour accountDisplay directory information to otherWebex users
Customer relationship management(e.g., transactional communication)
Provide you with the Service
Diagnose technical issues
Respond to Customer support requests
Make improvements to the Service andother Cisco products and services
Understand how the Service is used
Conduct analytics and statisticalanalysis in aggregate form to improve
the technical performance of theService

Version 12.0, September 16, 2024

Privacy Data Sheet

Doc type
Cisco public
•
•
•
•
•
•
•
•
•

Number of Meetings
Number of ParticipantsMeeting Host Information
Host Name and Email Address
Meeting Site URL
Meeting Start/End Time
Meeting Title
Meeting Attendee Information,
including Email Addresses
Information Submitted ThroughAttendee Registration Form
(optional, only applicable ifprovided by you)

3. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure. These technical andorganizational measures include the following:
Personal
Data
Category

Security Controls and Measures

User
Information

Encrypted in transit and at rest

Host and
Usage
Information

Encrypted in transit and at rest

4. Data Center Locations

Cisco uses third-party infrastructure providers to deliver the Service globally. Webex LTI and Webex LTI Legacy
are hosted only in US data centers. The hosting of Webex LTI and Webex LTI Legacy is separate from the hostingof other Webex services.
Data Center Location
Virginia, USA

5. Sub-processors

Cisco partners with service providers that act as sub-processors of personal data and contract to provide thesame level of data protection and information security provided to you by Cisco. The current list of subprocessors for Webex LTI and Webex LTI Legacy is set out below.
Sub-processor

Personal Data

Service Type

Location of Data Center

AWS (Amazon Web
Services)*•••

Virginia, USA

User Information
Host & Usage
Information

AWS cloud infrastructureis used to host Webex
LTI and Webex LTI
Legacy*Webex LTI and Webex LTI Legacy are hosted in their own AWS tenant in Virginia, USA, separate from infrastructure used by other Webex services.

©2024 Cisco and/or its affiliates. All rights reserved.

Version 12.0, September 16, 2024