Doc type
Cisco public

Privacy Data Sheet

Cisco Webex Meetings
This Privacy Data Sheet describes the processing of personal data (or personally identifiable information) by
Cisco Webex Meetings.
Cisco Webex Meetings is a cloud-based web and video conferencing solution made available by Cisco tocompanies or persons who acquire it for use by their authorized users.
Cisco will process personal data from Cisco Webex Meetings in a manner that is consistent with this Privacy
Data Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is the Data
Controller for the personal data processed to administer and manage the customer relationship. Cisco is theData Processor for the personal data processed by Cisco Webex Meetings in order to provide its functionality.
Note: This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement.

1. Overview

Cisco Webex Meetings (the “Service” or “Webex Meetings”) is a cloud-based web and video conferencing
solution made available by Cisco to companies or persons (“Customers,” “you,” or “your”) who acquire it for
use by their authorized users (each, a “user”). The Service enables global employees and virtual teams tocollaborate in real time from anywhere, anytime, on mobile devices or video systems as though they were
working in the same room. Solutions include meetings, events, training, and support services. For more
information regarding optional features for Cisco Webex Meetings, please see the Addendums below.
Because the Service enables collaboration among its users, as described below, your personal data is requiredin order to use the Service. The following paragraphs describe Cisco’s processing of personal data inconnection with the delivery of the Service, the location and transfers of that data, and how it is secured inaccordance with privacy principles, laws, and regulations. Cisco will use your personal data consistent with thisPrivacy Data Sheet to serve the legitimate interests and fulfill the contractual obligations of providing the
Solution.
This Privacy Data Sheet covers the Cisco Webex Meetings, Cisco Webex Events, Cisco Webex Training, andCisco Webex Support. If you use the Service together with the Cisco Webex app, see the see the Cisco Webex
app Privacy Data Sheet (available on The Cisco Trust Center) for descriptions of the data that may be collected
and processed in connection with those services.
For a detailed overview of the Service, please visit the Cisco Web Conferencing homepage.

2. Personal Data Processing

The Service allows users to instantly connect in a way that is almost as personal as a face-to-face meeting. If
you are a user and your employer is the Customer that acquired the Service, your employer serves as the “datacontroller” of data processed by the Service (see the Webex Meetings Privacy Data Map for a visualization of
who is doing what with data). The information described in the table below and in this Privacy Data Sheet isaccessible to your employer and is subject to your employer's policies regarding access, use, monitoring,deletion, preservation, and export of information associated with the Service.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Similarly, if users participate in meetings hosted by users in other companies, the meeting host will control any
meeting recordings or files shared during the meeting, which will be subject to the host’s corporate policies
regarding access, use, monitoring, deletion, preservation, and export of information. The meeting host has theoption to record meetings, which may be shared with others or discoverable in a legal matter. The meeting
host should inform all meeting attendees prior to recording and Webex displays a red circle and plays an audio
prompt to all participants indicating that the meeting is being recorded. Note, Cisco has no control over, and is
not responsible or liable for the privacy of any information that you have shared with others. Even after you
remove information from the Webex Meetings platform, copies of that information may remain viewableelsewhere to the extent it has been shared with others.
The table below list the categories of personal data used by the Service and describe why we process suchdata.
Cisco Webex Meetings does not:
•
•
•
•
•
•

Produce decisions that would result in legal or other significant effects impacting the rights ofdata subjects based solely by automated means.
Sell your personal data.
Serve advertisements on our platform.
Track your usage or content for advertising purposes.
Monitor or interfere with you your meeting traffic or content.
Monitor or track user geolocation.

Personal Data Category

Type of Personal Data

User Information

•
•
•
•
•
•
•
•
•

Host and Usage
Information

•
•
•
•
•
•
•
•
•
•
•

Purpose of Processing

Name
Email Address
Password
BrowserPhone Number (Optional)
Mailing Address (Optional)
Avatar (Optional)
User Information Included inYour Directory (if synched)
Unique User ID (UUID)(a pseudonymized 128-bit
number assigned to computenodes on a network)

We use User Information to:•
Provide you with the Service•
Enroll you in the Service•
Display your user avatar and profile to other users•
Make improvements to the Service and other Cisco
products and services•
Provide you support•
Customer relationship management (e.g.,transactional communication)•
Authenticate and authorize access to your account•Bill you for the Service•
Display directory information to other Webex users(Avatar may be cached locally on devices of otherWebex users that attend meetings with you for aperiod of 2 weeks)

IP Address
User Agent Identifier
Hardware TypeOperating System Type andVersion
Client Version
IP Addresses Along the Network
Path
MAC Address of Your Client (AsApplicable)
Service Version
Actions Taken
Geographic Region (i.e.,Country Code)We use Host and Usage Information to:•
Provide you with the Service•
Understand how the Service is used•
Diagnose technical issues
Conduct analytics and statistical analysis inaggregate form to improve the technicalperformance of the Service•
Respond to Customer support requests•
Make improvements to the Service and other Cisco
products and services©2022 Cisco and/or its affiliates. All rights reserved.

Cisco may use metadata from Webex meetings (e.g.,
meeting participants, frequencies) to:

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

•

•
•
•
•
•
•
•

•
•

•

User-Generated
Information•••

Meeting Session Information(e.g., date and time, frequency,
average and actual duration,
quantity, quality, network
activity, and network
connectivity)
Number of Meetings
Number of Screen-Sharing and
NonScreen-Sharing Sessions
Number of Participants
Screen Resolution
Join Method
Performance, Troubleshooting,and Diagnostics Information
Meeting Host Information1• Host Name and email
address• Meeting Site URL• Meeting Start/End Time
Meeting Title
Call attendee information,
including email addresses, IP
address, username, phone
numbers, room device
information
Information submitted throughattendee registration form
(Optional)•

Meeting Recordings (if enabled
by Customer)
Transcriptions of meeting
recordings (optional, only
applicable if enabled by you)
Uploaded Files (for Webex
Events and Training only)

We use User-Generated Information to:•
Provide you with the Service•

help organize, sort, and/or prioritize your Webex
app messages or spaces in a way that isrelevant to you and your work
Provide you the Personal Insights feature(optional)

CalendarIf you use a Webex plug-in with your Calendar service or utilize Webex Hybrid Calendar Services, we will only
use the data set forth above regarding meeting dates, times, title and participants. For more information on
Webex Hybrid Calendar Service see the Office 365 and Google Calendar integration references.

Technical Support Assistance

If a Customer reaches out to Cisco Technical Assistance Center (TAC) for problem diagnosis and resolution,
Cisco TAC may receive and process personal data from the Service. The Cisco TAC Service Delivery Privacy
Data Sheet describes Cisco’s processing of such data.

Control Hub

Cisco Webex Control Hub Analytics provides usage trends and valuable insights that can be used to help withstrategies to promote and optimize adoption across teams. Cisco Webex Control Hub Analytics uses Host andUsage information to provide advanced analytics capabilities and reports.

1

Used for billing purpose©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

Polling

As a presenter, you can use a poll to create and share questionnaires. Any polling data collected fromparticipants will be deleted once the meeting has ended. Some Webex Meetings may feature Slido, which is a
cloud-based polling and Q&A solution; for details around the processing of personal data by the Slido feature,please see Addendum 5 to this Privacy Data Sheet.

Extended Security Pack

If you purchase the extended security pack, please see the Cloudlock Privacy Data Sheet for Cloudlock data
privacy information.

3. Data Center Locations

The Service leverages its own data centers to deliver the Service globally. If you join a meeting using Cisco
Webex app, please see the Cisco Webex app Privacy Data Sheet for applicable privacy information, including
data center locations. The Webex Meetings data centers are currently located in the following countries (datacenter locations may change from time to time and this Privacy Data Sheet will be updated to reflect thosechanges):

Cisco Data Center Locations

Internet Point of Presence (iPOP) Locations

Amsterdam, Netherlands
Bangalore, India
California, USA
Frankfurt, Germany
London, UK
New York, USA
North Carolina, USA
Singapore, Singapore
Sydney, Australia
Texas, USA

Amsterdam, Netherlands
California, USA
Hong Kong, China
Illinois, USA
New Jersey, USA
Sydney, Australia
Texas, USA

Tokyo, Japan©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Toronto, Canada
Virginia, USA

User-Generated Information is stored in the data center in Customer’s region as provided during the ordering
process. Data is replicated across data centers within the same region to ensure availability. Billing informationis stored in the United States. Cisco Webex Analytics Platform data, which utilizes Host and Usage Information,is stored where you are provisioned and in the United States.
For free user accounts, the data defined in this privacy data sheet may be stored in a Webex data center
outside the account holder’s region.
An Internet Point of Presence (iPOP) Location is used to route traffic geographically from nearby areas to a
Cisco Data Center Location. It is intended to route Webex Meeting traffic through Cisco's infrastructure andimprove performance. Data routed through iPOP Locations remains encrypted and is not stored in that location.
Please see the Webex Meetings Privacy Data Map for a visual representation of the data flows.

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

5. Access Control

The table below lists the personal data used by Cisco Webex Meetings to carry out the service, who canaccess that data, and why.
Personal Data Category

Who has AccessPurpose of the Access

User Information

User through the My Webex Page

Modify, control, and delete User Information

Customer through the Site Admin
Page or Webex Control Hub
Cisco

Modify, control, and delete in accordance with Customer’s
personal data policy
Support the Service in accordance with Cisco’s data accessand security controls process

Host through the My Webex Page

View meeting session Information

Customer may view thisinformation through the Site Admin
Page, Webex Control Hub, or may
be otherwise provided by Cisco
Cisco

View usage, meeting session and configuration information

User through the My Webex Page

Modify, control, and delete based on user’s preference

Customer using APIs provided with
the Service or through the Site
Admin Page or Webex Control Hub

Modify, control, and delete in accordance with Customer’s
personal data policy

Host and Usage
Information

User Generated
Information©2022 Cisco and/or its affiliates. All rights reserved.

Support and improvement of the Service by the Cisco Webex
Meetings support and development teamVersion 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Cisco

Other Customers and users (whenshared during a meeting)

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer, and will only
access it in accordance with Cisco’s data access and security
controls process.
Content you choose to share during a meeting may beaccessed by users in the meeting, wherever they are located.
Even after you remove information from the Service, copies ofthat content may remain viewable elsewhere to the extent it
has been shared with others.

6. Data Portability

The Service allows Customers and users to export all User-Generated Information. A Customer’s administrator
may do so using APIs provided with the Service (recordings only) or through the Site Admin Page; while
individual users may do so through the My Webex Page. Meeting recordings are available in standard mp4
format .
Customers are permitted to export personal data collected about their users on the Webex Meetings platformusing APIs or via the Site Admin Configuration.

7. Data Deletion and Retention

Subject to their employer’s corporate retention policies, users with an active subscription can delete UserGenerated Information from their account through the My Webex Page at any time during the term of theirsubscription. Enterprise Customers have the ability to set organization-wide retention periods for recordings
using APIs. Cisco provides free account users up to 6 months of free storage.
The table below lists the personal data used by Cisco Webex Meetings, the length of time that data needs tobe retained, and why we retain it.
Users seeking deletion of User Information and User Generated Information retained on their employer’s Webex
Meetings site must request deletion from their employer’s site administrator.
Type of Personal Data

Retention Period

Reason for Retention

User Information

Active Subscriptions:•User Information will
be maintained as longas Customer maintains
active subscription(paid or free).

Name and UUID are maintained 7 years from termination as partof Cisco’s business records and are maintained to comply with
Cisco’s financial and audit requirements. Any billinginformation is also subject to this retention period.

Terminated Service:•
Deleted once theService is terminated•
Name and UUID aremaintained 7 years
from termination
Host and Usage
Information

3 years

Host and Usage is kept as part of Cisco’s record of Service
delivery.
* Any billing information is retained for 7 years as part of
Cisco’s business records and are maintained to comply with
Cisco’s financial and audit requirements. Once the specified©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

retention period has expired, data will be deleted oranonymized.
User Generated
Information

Active Subscriptions:•
At Customer’s or user’s
discretion
Terminated Service:
Deleted within 60 days

User-Generated Information is not retained on the Webex
Meetings platform when Customer or user deletes this data.
User Generated Information is retained for 60 days after
services are terminated to give Customers opportunity to
download.

8. Personal Data Security

The Service adopts technical and organizational security measures designed to protect your personal data fromunauthorized access use or disclosure. Additional information about our encryption architecture is summarized
in the table and paragraphs below.
Personal Data Category

Security Controls and Measures

User Information

Encrypted in transit and at rest

Passwords (stored if Single Sign On is
not configured)
Host and Usage Information

Encrypted and hashed in transit and at rest

User Generated Information

Recordings prior to May 2018 were encrypted in transit with the option to encrypt atrest. Recordings created after May 2018 are encrypted in transit and at rest by
default. Recordings created in the Webex Meetings FedRAMP-Authorized service
after October 2019 are encrypted in transit and at rest.

User Information

Encrypted in transit and at rest

Encrypted in transit and at rest

Protecting Data at Rest

The Service encrypts User Information, Passwords and User Generated Information, as described above, at
rest.

Encryption of Data in Transit

All communications between cloud registered Webex Apps, Webex Room devices and Webex services occur
over encrypted channels. Webex uses the TLS protocol with version 1.2 or later with high strength cipher suites
for signalling.
After a session is established over TLS, all media streams (audio VoIP, video, screen share, and document share)are encrypted.
Encrypted media can be transported over UDP, TCP, or TLS. Cisco prefers and strongly recommends UDP as
the transport protocol for Webex voice and video media streams. This is because TCP and TLS are connection
orientated transport protocols, designed to reliably deliver correctly ordered data to upper-layer protocols. Using
TCP or TLS, the sender will retransmit lost packets until they are acknowledged, and the receiver will buffer the
packet stream until the lost packets are recovered. For media streams over TCP or TLS, this behaviour manifests
itself as increased latency/jitter, which in turn affects the media quality experienced by the call’s participants.
Media packets are encrypted using either AES 256 or AES 128 based ciphers. The Webex App and Webex Roomdevices uses AES-256-GCM to encrypt media; these media encryption keys are exchanged over TLS-secured
signalling channels. SIP and H323 devices that support media encryption with SRTP can use AES-256-GCM,©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

AES-128-GCM, or AES-CM-128-HMAC-SHA1 (AES-256-GCM is the Webex preferred media encryption
cipher).

Zero Trust Security Based End-to-End Encryption

For standard Webex Meetings, where devices and services use SRTP to encrypt media on a hop by hop basis,
Webex media servers need access to the media encryption keys to decrypt the media for each SRTP call leg.
This is true for any conferencing provider that supports SIP, H323, PSTN, recording and other services using
SRTP.
However, for businesses requiring a higher level of security, Webex also provides end-to-end encryption for
meetings (“Webex Zero Trust Security end-to-end encryption”). With this option, the Webex cloud does not haveaccess to the encryption keys used by meeting participants and cannot decrypt their media streams. Webex
Zero Trust Security end-to-end encryption uses standard track protocols to generate a shared meeting
encryption key (Messaging Layer Security (MLS)) and to encrypt meeting content (Secure Frame (S-Frame). With
MLS, the meeting encryption key is generated by each participant’s device using a combination of the sharedpublic key of every participant and the participant’s private key (never shared). The meeting encryption key does
not traverse the cloud and is rotated as participants join and leave the meeting. For more details on Zero Trust
Security based end-to-end encryption see the Zero Trust Security for Webex white paper.
With end-to-end encryption, all meeting content (voice, video, chat, etc.) is encrypted using the locally derived
meeting encryption key. This data cannot be deciphered by the Webex service.
Note that when end-to-end encryption is enabled, Webex services and endpoints that need access to meetingkeys to decrypt content (e.g. devices using SRTP where encryption is performed hop by hop) are not supported.
This restricts meeting participants to those using the Webex App or cloud registered Webex devices only, andexcludes services such as network-based recording, speech recognition etc. The following features are also notsupported:
•
•
•
•
•
•
•

Join Before Host
Video-device enabled meetings
Linux clients
Network-Based Recording (NBR)
Webex Assistant
Saving session data transcripts, Meeting Notes
PSTN Call-in/Call-back

9. Sub-processors

We may share data with service providers, contractors or authorized third parties to assist in providing andimproving the Service. We do not rent or sell your information. All sharing of information is carried out
consistent with the Cisco Privacy Statement and we contract with third-party service providers that can provide
the same level of data protection and information security that you can expect from Cisco. Below is a list of
sub-processors for Webex Meetings.
All Cisco sub-processors undergo a rigorous security and privacy assessment to confirm their compliance with
our requirements. They are further bound by a data processing agreement which incorporates the EU Standard
Contractual Clauses and places strict limits on their use and processing of any data provided by us or our Webex
customers and users.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Sub-processor

Personal Data

Service Type

Location of Data Center

AkamaiIP address, Browser
andGeographic region

Akamai is used as content delivery
network (CDN) services provider for
static content.

Location generally maps toCustomer’s Webex data centerassignment.

Akamai does not store content but
may store IP address in logs for a
maximum of 3 years.

To the extent Akamai receives IP
addresses of Webex Meetingcustomers, those IP addresses may
be transmitted to the United Stateswith strict access control means andappropriate safeguards under the EU
Standard Contractual Clauses(SCCs).

AWS cloud infrastructure is used tohost the Webex signaling service thatprocesses meeting participant
UUIDs, meetings start and end times.
Data will be deleted within 15 daysof the meeting. (Location maps toCustomer’s Webex data centerassignment)

United States
Germany
Netherlands
United Kingdom
BrazilAustralia
Japan
Singapore

Amazon Web Services(AWS)

Limited Host & Usage
Information

AWS cloud infrastructure is used tohost Webex media nodes that may
process real-time meeting data such
as VoIP, video and high frame rate
sharing data. This information is notretained in AWS once your meetinghas ended.
WalkMe2

Unique User ID (UUID)
and user region

Provides user with a step-by-steptour and guidance on how to use
Webex Meetings online site.

Globally

Vbrick (WIP)

Name, UUID, email
address

Vbrick provides users with extended
capacity for Webex Meetings
including over 3,000 participants.
Vbrick requires the data forauthentication and the data is
encrypted in transit. Vbrick does notstore Webex customer personal
data.

United States
EU: Germany, Ireland
Australia

If a Customer acquires the Service through a Cisco partner, we may share any or all of the information
described in this Data Sheet with the partner. Customers have the option of disabling this information-sharing
with Cisco partners. If you use a third-party account to sign-in to your Webex account, Cisco may share only
the necessary information with such third party for authentication purposes.

10. Information Security Incident Management
Breach and Incident Notification Processes

The Information Security team within Cisco’s Security & Trust Organization coordinates the Data Incident
Response Process and manages the enterprise-wide response to data-centric incidents. The Incident
Commander directs and coordinates Cisco’s response, leveraging diverse teams including the Cisco Product2

Customers may turn this feature off at any time. Feature is currently enabled for non-enterprise Webex sites.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Security Incident Response Team (PSIRT), the Cisco Security Incident Response Team (CSIRT), and theAdvanced Security Initiatives Group (ASIG).
PSIRT manages the receipt, investigation, and public reporting of security vulnerabilities related to Cisco
products and networks. The team works with Customers, independent security researchers, consultants,
industry organizations, and other vendors to identify possible security issues with Cisco products and networks.
The Cisco Security Center details the process for reporting security incidents.
The Cisco Notification Service allows Customers to subscribe and receive important Cisco product andtechnology information, including Cisco security advisories for critical and high severity security vulnerabilities.
This service allows Customers to choose the timing of notifications, and the notification delivery method (email
message or RSS feed). The level of access is determined by the subscriber's relationship with Cisco. If you
have questions or concerns about any product or security notifications, contact your Cisco sales representative.

11. Certifications and Compliance with Privacy Requirements

The Security & Trust Organization and Cisco Legal provide risk and compliance management and consultation
services to help drive security and regulatory compliance into the design of Cisco products and services. The
Service is built with privacy in mind and is designed so that it can be used in a manner consistent with global
privacy requirements., , including the EU General Data Protection Regulation, California Consumer Privacy Act,
Canada’s Personal Information Protection and Electronic Documents Act and Personal Health Information
Protection Act.
In addition to the Cross-Border Data Transfer Mechanisms/Certifications listed in Section 4, Cisco has thefollowing:••

EU-US Privacy Shield Framework
Swiss-US Privacy Shield Framework

Further, In addition to complying with our stringent internal standards, Cisco also continually maintains thirdparty validations to demonstrate our commitment to information security. The Service has received thefollowing certifications:

•
•
•
•
•
•
•

EU Cloud Code of Conduct Adherence by SCOPE Europe
ISO 27001, 27017, 27018, 27701
SOC 2 Type II Attestation, SOC 3, + C5
CSA STAR 2
FedRAMP
Esquema Nacional de Seguridad (ENS) (Spain)
Information System Security Management and Assessment Program (Japan)

12. Exercising Data Subject Rights

Users whose personal data is processed by the Service have the right to request access, rectification,suspension of processing, or deletion of the personal data processed by the Service.
We will confirm identification (typically with the email address associated with a Cisco account) before
responding to the request. If we cannot comply with the request, we will provide an explanation. Please note,users whose employer is the Customer/Controller, may be redirect to their employer for a response.
Requests can be made by submitting a request via:

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

1) the Cisco Privacy Request form
2) by postal mail:Chief Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAmericas Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAPJC Privacy Officer
Cisco Systems, Inc.
Bldg 80, Lvl 25, Mapletree Biz City,
80 Pasir Panjang Road,
Singapore, 117372
SINGAPORE

EMEAR Privacy Officer
Cisco Systems, Inc.
Haarlerbergweg 13-19, 1101 CH
Amsterdam-Zuidoost
NETHERLANDS

We will endeavor to timely and satisfactorily respond to inquiries and requests. If a privacy concern related tothe personal data processed or transferred by Cisco remains unresolved, contact Cisco’s US-based third-party
dispute resolution provider. Alternatively, you can contact the data protection supervisory authority in yourjurisdiction for assistance. Cisco’s main establishment in the EU is in the Netherlands. As such, our EU leadauthority is the Dutch Autoritiet Persoonsgegevens.

13. General Information

For more general information and FAQs related to Cisco’s Security and Privacy Program please visit The Cisco
Trust Center.
Cisco Privacy Data Sheets are reviewed and updated on an annual, or as needed, basis. For the most current
version, go to the Personal Data Privacy section of the Cisco Trust Center.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

Addendum One: People Insights for
Cisco Webex

This Addendum describes the processing of personal data (or personal identifiable information) by People
Insights for Cisco Webex Meetings and Cisco Webex.
People Insights for Cisco Webex Meetings and Cisco Webex is a cloud-based company directory solution
made available by Cisco to companies or persons who acquire it for use by their authorized users.
Cisco will process personal data from People Insights for Cisco Webex Meetings and Cisco Webex in a mannerthat is consistent with this Privacy Data Sheet. In jurisdictions that distinguish between Data Controllers andData Processors, Cisco is the Data Controller for the personal data processed to administer and manage thecustomer relationship. Cisco is the Data Processor for the personal data processed by Cisco Webex Meetingsin order to provide its functionality.
Note: This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement.

1. Overview

The People Insights feature (“People Insights” or the “Feature”) provides Cisco Webex users withcomprehensive, publicly available business and professional information for meeting participants giving users
context and increased insight about the people with whom they collaborate. People Insights only displays
publicly available information, similar to what can be found in search engine results for a person's name andprofession. People Insights will also display internal company directory information to users in the same
company. This internal directory information is not visible to users outside the company. The People Insights
database doesn't look behind logins or paywalls, which means your profile won't be populated with content
from sites like Facebook.
People Insights was designed with data protection and privacy in mind, and is aligned to global privacy
requirements, including GDPR. This feature provides users with a convenient single view into their alreadyexisting public presence and digital footprint. As outlined below, People Insights includes functionality to honor
data subject rights. Users fully own their People Insights profile and can change or hide the profile to keep
information private.
People Insights is enabled by default for U.S. provisioned Customers. Customers provisioned in the EU must
opt-in to this feature. Users at an enabled organization can opt-out of People Insights by suppressing theirprofile from other meeting participants’ view. This is accomplished in two ways:
1. Entering a meeting and selecting the “Hide Profile” link,
2. Signing into people.webex.com and clicking on “Hide Profile”
If you join a meeting, or a teamspace, hosted by a Cisco Customer that has People Insights enabled on theirsite, all participants’ People Insight profiles will be visible unless they have chosen to hide their profiles as
described above.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

2. Personal Data Processing

People Insights compiles business and professional profiles for meeting participants using publicly available
and legitimately sourced information, published authored works, news articles, search engine results, via APIs
and through content supplied by the profile owner.
The table below lists the personal data processed by People Insights to provide its services and describes why
the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

Publicly Available Businessand Professional
Biographical Data

•
•
•
•
•
•
•
•

Profile Photos
News
TweetsAuthored Works
Bios
Employment History
Education History
Web Links for a specificperson•To source the People Insights profile and to enablesearch within the feature.

Account & Usage
Information

User Level Account Details(including email, name, and webinteractions and platform usage)••

To provide support and improvement of the Feature
Product analytics (e.g. frequency of profile edits, # ofsuccessful profile loads in a meeting, etc.)

Directory Data•

If the directory option isenabled by the site
administrator, professional
information including thefollowing may be collectedfrom the internal company
directory (as selected by theadministrator):
•
Title
•
Phone Number•
Location•
Organization•
Department
•
Photo
•
Role
•
Reporting Structure•

To augment the user’s People Insights profile byproviding company specific context to meeting
participants who belong to the same organization.
This data will only be visible to participants within theuser’s organization.

User Generated
Information•

Information that the user adds
in their People Insights profile.

•

Augment the user’s own People Insights profile(visible to Insights users)

3. Data Center Locations

People Insights data is stored on third party servers provided by Amazon Web Services (“AWS”). AWS servers
are located in the United States.

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

•
•
•
•

Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

5. Access Control

The table below lists the personal data used by People Insights to carry out the service, who can access thatdata, and why.
Personal Data Category

Who has accessPurpose of the accessPublicly Available
Business andProfessional Biographical
Data
Account & Usage
Information

Cisco
Users of Customer Webex site withenabled People Insights

To provide the Feature

Cisco

Registration Support
Correlate users with correct profiles
Analytics to improve service

Customer

Feature enablement/disablement.

Customer (Admin)
People Insight users within the
Customer’s organization
Cisco

Directory data is provided and maintained by customer
administrator to allow integration into People Insights profile.

User

Users may access their own User-Generated Information toedit or delete content.

Directory Data

User-Generated
Information

Directory data is imported and integrated with customer
profile data to support profile development

6. Data Portability

Individuals can receive a copy of their own People Insights profile, including their self-generated information,
through the Cisco Privacy Request form

7. Data Deletion and Retention

The table below lists the personal data used by People Insights, the length of time that data needs to beretained, and why we retain it.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco publicType of Personal Data

Retention Period

Reason for Retention

Publicly Available
Business & Professional
Data

Obtained from public websites:
Indefinite

Publicly Available Business & Professional Data is derived frompublic sources. It is retained indefinitely by default. Upon
request, publication and links to source data can besuppressed and restricted from view and publication.

Obtained through third-party
APIs: In accordance with
contractual requirements

As publicly available data originates from outside of Cisco
WebEx, any permanent changes or deletions must be
addressed and requested with the primary source.
At the request of users, the data can be archived in order to notappear. This allows for the data to remain permanently hidden
rather than re-appearing with a new search after being
previously purged.

Account & Usage
Information

Active Subscriptions:
At Customer’s or user’s
discretion

Users can request to remove their Account Information by
opening a TAC service request. Cisco will respond to such
requests within 30 days.

Deactivated Accounts:
Deleted within thirty (30) days
Directory Data

Active Subscriptions:
At Customer’s or user’s
discretion
Deactivated Accounts:
Deleted within thirty (30) days

User-Generated
Information

Active Subscriptions: At
Customer’s or user’s discretion

Administrators can disable Active Directory feature while still
enabling People Insights. Directory data will be hard deleted inthis case of deactivation. Non-directory data will remain, withthe exception of name and email for users who had only
directory data in their profile before the deactivation.
Users can delete User-Generated Information from their profileat any time.

Deactivated Accounts: Deleted
within thirty (30) days

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
Personal Data Category

Security controls and measures

Publicly Available Business &Professional Data
Host & Usage Information

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

Directory Data

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

User-Generated Information

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

Encrypted in transit, AES 256 for storage, Keys managed through AWS KMS

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for theservice is below:©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services

Cloud Storage

United States

Amplitude• Publicly Available
Business & Professional
Data• Host & Usage Information• Directory Data
• User-Generated
Information• Host & Usage Information

User Analytics

United States

Diffbot• Name, EmailSupplementing Publicly Available Business &Professional Data

United States©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

Addendum Two: Facial Recognition for
Cisco Webex Meetings (Optional)
This Addendum describes the processing of personal data (or personal identifiable information) by Facial
Recognition feature for Cisco Webex Meetings. The Facial Recognition feature is only available when using
Webex Meetings on certain Cisco Endpoint devices.
Facial Recognition feature for Cisco Webex Meetings is a cloud-based feature solution made available by Cisco
to companies or persons who acquire it for use by their authorized users.
Cisco will process personal data from Facial Recognition feature for Cisco Webex Meetings in a manner that is
consistent with this Privacy Data Sheet. In jurisdictions that distinguish between Data Controllers and Data
Processors, Cisco is the Data Controller for the personal data processed to administer and manage thecustomer relationship. Cisco is the Data Processor for the personal data processed by Cisco Webex Meetingsin order to provide its functionality.
Note: This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement.

1. Overview

Cisco introduced the facial recognition feature (“Facial Recognition” or the “Feature”) to provide Webex
Meetings users with the ability to identify and recognize registered Webex meeting participants (i.e., associateparticipant names with their positions in a Webex meeting video), giving users increased connection to meeting
participants. The Feature recognizes a face by converting it to an abstracted facial vector. A facial vector is alist of numbers that characterize salient facial features of a user that is then used to identify who is in themeeting. This level of abstraction allows the system to recognize the same face even when things like lighting
and position change.
Facial Recognition is disabled by default, and requires affirmative action by both the Customer and the user toenable. First, the administrator for the Customer may enable Facial Recognition using Webex Control Hub.
However, the feature will not be available on the user’s account until the user opt-ins at
https://settings.webex.com. Because the Feature is based on facial vectors derived from profile images, theuser must have a picture taken at the time of enablement.

2. Personal Data Processing

If the user opts-in to the Facial Recognition feature, the service uses the camera of the user’s device to take aprofile picture. This picture is sent to the Webex cloud where the Feature algorithm generates a facial vector
from the picture so that it can be used for matching as further described below. Both the picture and the facial
vector are encrypted and stored securely. The picture may be used to generate a new facial vector in theevent Cisco updates or modifies the algorithm by which facial vectors are generated. In the event a customer
or user reaches out to Cisco for support with the Feature, Cisco may also use the picture during thetroubleshooting process. During each meeting, a second facial vector is generated, then matched in theWebex cloud against the stored facial vector. This second facial vector is not retained.
The table below lists the personal data processed by Facial Recognition feature to provide its services anddescribes why the data is processed.
©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Personal Data Category

Type of Personal Data

Purpose of Processing

User Information•••

Name (First, Last)
EmailUser ID••

To display name of recognized user
Enroll you in the Feature and enable opt-in

Biometrics••

User facial image
Facial vector mapping•

To create facial vector mapping and provide the facialrecognition feature
To generate a new facial vector in case of amodification or update to the Feature algorithm•

Host & Usage Information•

Information regarding
accuracy of product,
including:oSuccessful andunsuccessful facial
vector matchingoUser feedback•

To provide support and product analytics

Location•

Meeting Room Proximity data•

Calendar•Meeting Room Calendar
Information•

Proximity data is used to improve Facial
Recognition to assure facial vectors arematched to the correct users in the correct
locations
Calendar information is used to improve Facial
Recognition to assure facial vectors arematched to the correct users in the correct
locations

3. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

4. Access Control

The table below lists the personal data used by Facial Recognition feature to carry out the service, who canaccess that data, and why.
Personal Data Category

Who has accessPurpose of the access

User Information

Cisco

•
•

To display name of recognized user
Enroll you in the Feature and enable opt-in

Customer•

View user facial recognition registration status

Users throughhttps://settings.webex.com/•

View and modify facial recognition registration details

Cisco

•
•
•

To provide the Facial Recognition feature
Algorithm improvement
To troubleshoot issues in the event Customer or users
request support

Biometrics©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Host & Usage Information

Cisco

•

To provide support and product analytics

Location

Cisco•

Proximity data is used to improve Facial Recognition toassure facial vectors are matched to the correct users in
the correct locations

Calendar

Cisco•

Calendar information is used to improve Facial
Recognition to assure facial vectors are matched to thecorrect users in the correct locations

5. Data Portability

While Webex Meetings allows Customers and users to export data as described in Section 5 of the Webex
Meetings Data Privacy Sheet, it does not support the automatic export of Facial Recognition data.

6. Data Deletion and Retention

The table below lists the personal data used by Facial Recognition feature, the length of time that data needs tobe retained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

User ID is maintained for all active
Webex Meetings users. Once a user
is deleted from a Customer’s
account, the User ID is also deleted
from the Facial Recognition service.

UserID is used to track your enrollment in the Feature

Biometrics

All other User Information is notstored or retained by the Facial
Recognition service as thisinformation is already stored byWebex Meetings.
Images: Users control their image
retention. The image is retained aslong as the feature is enabled andthe user leaves the image associatedwith their profile. The image can bedeleted at any time by user.
Images for all users are deleted uponcustomer’s discontinuation of theservice.
Facial vectors are retained as long as
the facial images, but are stored
separately.

Names are displayed upon a match in the facial recognition
feature.

The image is used to provide the Facial Recognition feature,
update the facial vector in case of an update to thealgorithm, and to troubleshoot issues when requested by acustomer or user.

The facial vectors are used to provide the facial recognition
feature.

Facial vectors are deleted upon
discontinuation of the service.
Host & Usage Information

2 weeks©2022 Cisco and/or its affiliates. All rights reserved.

To provide support and product analytics

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Location

2 days

Proximity data is used to improve facial recognition toassure images are assigned to the correct users in thecorrect locations.

Calendar

Facial Recognition does not store or
retain this information separately
than already maintained by Webex
Meetings.

7. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for the Facial Recognition
feature.
Personal Data Category

Security controls and measures

User Information

Encrypted in transit, AES 256 for storage

ImagesEncrypted in transit, AES 256 for storage

Biometrics

Encrypted in transit, AES 256 for storage

Host & Usage Information

Encrypted in transit, AES 256 for storage

Location

Encrypted in transit, AES 256 for storage©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

Addendum Three: Webex Assistant for
Meetings (Optional)
This Addendum describes the processing of personal data (or personal identifiable information) by Webex
Assistant for Meetings (“Webex Assistant” or “Assistant”) feature for Cisco Webex Meetings.
Webex Assistant for Meetings is a cloud-based feature made available by Cisco to companies or persons who
acquire it for use by their authorized users.
Cisco will process personal data from Webex Assistant for Meetings in a manner that is consistent with thisPrivacy Data Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is theData Controller for the personal data processed to administer and manage the customer relationship. Cisco is
the Data Processor for the personal data processed by Cisco Webex Meetings in order to provide its
functionality.
Note: This Privacy Data Sheet is a supplement to the Cisco Online Privacy Statement.

1. Overview

Webex Assistant for Meetings is an intelligent, interactive virtual meeting assistant that makes meetings
searchable, actionable, and more productive. When Webex Assistant is turned on, the meeting host andparticipants can capture meeting highlights with one click or through a voice command. Even when Webex
Assistant joins a Meeting, it will only be activated by the wake word, “OK Webex.” Once the wake word is
detected, the voice command is streamed to the cloud for speech-to-text transcription and processing. Any
participant can use one of many voice commands and create a meeting highlight. Meeting Highlights can
include meeting key points, notes, summaries, agendas, action items or decisions. Webex Assistant can also
show captions so that no one misses a word of what's being said. Additionally, a meeting host can record themeeting to get a post-meeting transcript.
Webex administrators can provision Webex Assistant for Meetings for an organization, an entire Webex site, orfor specific users through license assignment. A Customer’s administrator can enable and disable Webex
Assistant at any time. The administrator may also set the Assistant default to be either ON or OFF at meetingstart times. If the Assistant is set to default ON by an administrator, the Assistant will be on when the meeting
begins but can be disabled. If Assistant setting is set to OFF, the meeting host will have to explicitly turn on theAssistant in the meeting in order to use it.
Cisco has put several controls in place to ensure user transparency. When Webex Assistant is enabled, theWebex Assistant icon appears in the lower left of the host and participant's screen. On Webex endpoint
devices, there will be a visual cue similar to the existing one you see when a meeting is recorded. Additionally,
when the host turns on Webex Assistant in a meeting, there will be an audio announcement made to allparticipants on the call, even if they join late. As further described below, the host can choose to share thetranscript and meeting highlights with other Webex Meeting users.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

2. Personal Data Processing

The table below lists the personal data processed by Webex Assistant for Meetings to provide its services anddescribes why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information

•
•
•
•
•
•

Name (First, Last)
Email
Username
Unique User Identifier (UUID)
Meetings Recordings
Audio Commands to Webex
Assistant
Audio captured during
meeting•••

Provide the Webex Assistant Service
When you utilize the real time translation andtranscription feature in multiple languages, data may
be used for product improvement. You may opt-outof this use by submitting a request here.

Audio Information••

Provision Webex Assistant licenses to specific Webex
Meeting users or to an entire organization or site
Provide the Webex Assistant service

Transcript Information•••

Meeting Transcript
Text of meeting Highlight
Text of real time speech fortranslations••

Provide the Webex Assistant service
When you utilize the real time translation andtranscription feature in multiple languages, data may
be used for product improvement. You may opt-outof this use by submitting a request here.

Host and Usage
Information•

Usage of the Webex Assistantfeatures, including number of
meetings with Assistantenabled, number/type ofHighlight
views/edits/downloads,
troubleshooting events

•
•
•
•
•

Provide the Webex Assistant service
Understand how the Service is used
Provide Customer with usage information
Diagnose technical issues
Improve the technical performance of the Service

3. Data Center Locations

Cisco leverages its own data centers as well as third-party hosting providers and business partners to deliver
the Service globally.
Webex Assistant Audio and Transcript Information will be stored in the same location in which the Customer isprovisioned for Webex Meeting recordings. Although Webex Assistant may process data in AWS as listed in
Section 9 below, no data will be stored there.

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

5. Access Control

The table below lists the personal data used by Webex Assistant for Meetings to carry out the service, who canaccess that data, and why.
Personal Data Category

Who has accessPurpose of the access

User Information

Cisco

Enroll the to the Webex Assistant service.

Customer

Provision Webex Assistant licenses to specific Webex
Meeting users or to an entire organization or site

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls process.

Customer

Customer will continue to have access to Meeting Recordingsin accordance with Customer’s personal data policy and as
described in the Meetings Privacy Data Sheet.

User

A meeting host will be able to view, access and/or delete
Highlights. A host may share and give certain edit
permissions to other Webex Meetings users.

Cisco

While Cisco operates the Service, Cisco will not access thisdata unless it is shared with Cisco by Customer and will only
access in accordance with Cisco’s data access and security
controls.

User

A meeting host will be able to view, access and/or share
Transcript Information. A host may share and give certain
edit permissions to other Webex Meetings users.

Cisco

Support and improve the Service in accordance with Cisco’s
data access and security controls.

Customer

View and analyze usage information.

Audio Information

Transcript Information

Host and Usage
Information

6. Data Portability

Users have the option to email any transcript or Highlight to a selected email account.

7. Data Deletion and Retention

Subject only to their employer’s corporate retention policies, users with an active subscription have control overtheir Audio and Transcript Information and can delete such information from their account through the My
Webex Page as described below. If you have any questions regarding deletion or deletion requests, pleasecontact Cisco through the Cisco Privacy Request Form. .
The table below lists the personal data used by Webex Assistant for Meetings, the length of time that dataneeds to be retained, and why we retain it.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco publicType of Personal Data

Retention Period

Reason for Retention

User Information

User Information is not separately
stored or retained by the Webex
Assistant service as thisinformation is already stored byWebex Meetings.

Audio Information

Active Subscriptions: Audio
Information deleted atCustomer’s or user’s discretion.

Audio Information is retained in order to provide you with theService and will be deleted once it is no longer necessary toprovide the Service.

Terminated Service: Deleted
within 60 days

Audio Information retained after the Service is terminated isdone in order to make it available to Customers for download.

Audio Information related to real time translation andtranscription in multiple languages is retained for 2 years
for product improvement. You may opt-out of this use bysubmitting a request here.

Transcript Information

Active Subscriptions: Highlights
may be deleted at Customer’s oruser’s discretion.

Transcript Information is retained in order to provide you with
the Service and will be deleted once it is no longer necessary
to provide the Service.

Terminated Service: Deleted
within 60 days

Transcript Information retained after the Service is terminatedis done in order to make it available to Customers for download

Transcription Information related to real time translation andtranscription in multiple languages is retained for 2 years
for product improvement. You may opt-out of this use bysubmitting a request here.

Host and Usage

Deleted after 3 years.

Usage information used to conduct analytics and measurestatistical performance is retained but pseudonymized.

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for Webex Assistant.
Personal Data Category

Security controls and measures

User Information

Webex Assistant does not store or retain this information separately than already maintained byWebex Meetings.

Audio Information

Encrypted in transit and at rest.

Transcript Information

Encrypted in transit and at rest.

Host and Usage

Encrypted in transit and at rest.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for theservice is below:
Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services

Audio Information• Cloud Infrastructure (transient storage only)

US, , Singapore,
France, Japan,
Ireland, Sweden

GoogleAudio and transcript ofVoice Command only (e.g.,“Ok, Webex, create anote”).

• Speech to Text service (voice commands
only)• Text to Speech service (voice command
responses only)

US, Germany,
Singapore,
Netherlands,
Belgium, Japan• Provide translation using text of real timespeech. This may be retained up to 14 days incase of service failure but will not be usedother than to provide you with the Service.
• When you add-on and use the real timetranslation and transcription feature in multiple
languages, Google may process but not store
Audio Information to provide speech-to-text
services

Globally

Please note that the coretranscription technologythat processes and stores
all other Audio andTranscript Information is
owned, managed andexecuted by Cisco.
Google*Transcript Information

Audio Information (except
if spoken language chosen
is English)

Globally*These sub-processors will only apply to you if you have purchased and are using real-time translation andtranscription in multiple languages.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Addendum Four: Webex Assistant for
Rooms
This Addendum describes the processing of personal data (or personal identifiable information) by Webex
Assistant for Rooms.
Webex Assistant for Rooms is a cloud-based feature made available by Cisco to companies or persons who
acquire it for use by their authorized users.
Cisco will process personal data from Webex Assistant for Rooms in a manner that is consistent with thisPrivacy Data Sheet. In jurisdictions that distinguish between Data Controllers and Data Processors, Cisco is theData Controller for the personal data processed to administer and manage the customer relationship. Cisco is
the Data Processor for the personal data processed by Cisco Webex Meetings in order to provide its
functionality.

1. Overview

Webex Assistant for Rooms gives you a new way to control your devices by using voice commands. Throughvoice commands, a user is able to join meetings, control meeting settings and more. Webex Assistant isdisabled by default and can be enabled by the Organization’s administrator in Webex Control Hub.
Webex Assistant is activated by the wake word, “OK Webex.” Once the wake word is detected, speech isstreamed to the cloud for speech-to-text transcription. As wake word processing is local on the device, noaudio data is stored, processed or streamed to the cloud until the wake word is detected. After the wake word
and command are processed, the resulting text from the speech engine is returned to the Webex Assistantclient on the endpoint device and displayed to the user. Although Webex Assistant for Rooms securely
manages functional interactions with Google Speech Services to enable the service, data is not stored or
further processed by Google for any other purpose than to provide you with the service.

2. Personal Data Processing

The table below lists the personal data processed by Webex Assistant for Rooms to provide its services anddescribes why the data is processed.
Personal Data Category

Type of Personal Data

Purpose of Processing

User Information

•

•
•

•

Synched Corporate Directory
information (e.g., name, email,title)For users who pair with Cisco
endpoint device:oUnique User IdentifieroFirst Nameo
Display name©2022 Cisco and/or its affiliates. All rights reserved.

Provide the Webex Assistant service
Improve Webex Assistant’s accuracy to user’scommand

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Audio

•

User audio commands•

Provide the Webex Assistant service

Transcripts•

Text of command••

Provide the Webex Assistant service
Train and/or improve Cisco language services

Usage

•

Webex Assistant usage
information (e.g., number ofqueries from endpoint
devices, dates)
Endpoint devices used•••

Understand how the Webex Assistant service is used
Diagnose technical issues
Improve the technical performance of theWebex
Assistant service•

3. Data Center Locations

Cisco leverages its own data centers as well as third-party hosting providers and business partners to deliver
the Service globally. These entities are currently located in the following locations (data center locations maychange from time to time and this Privacy Data Sheet will be updated to reflect those changes):
Data Center Locations
Germany
United States

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

5. Access Control

The table below lists the personal data used by Webex Assistant for Rooms to carry out the service, who canaccess that data, and why.
Personal Data Category

Who has accessPurpose of the access

User Information

Cisco

Audio

Cisco

Enable, support and improve the Webex Assistant service inaccordance with Cisco’s data access and security controls
process.
Provide the Webex Assistant service

Transcripts

Cisco

Support, train and improve the Webex Assistant service.
Understand how the product is being used.

Usage Information

Cisco

Support and improve the Service in accordance with Cisco’s
data access and security controls process. Understand how
the product is being used.

Customer

View and analyze some usage information on Control Hub.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

6. Data Portability

While Webex Meetings allows Customers and users to export data as described in Section 5 of the Webex
Meetings Data Privacy Sheet, it does not support the export of Webex Assistant for Rooms data.

7. Data Deletion and Retention

The table below lists the personal data used by Webex Assistant for Rooms, the length of time that data needs
to be retained, and why we retain it.
Type of Personal Data

Retention Period

Reason for Retention

User Information

Stored while Customer isenrolled in the service.

User Information is retained in order to provide you with theservice and will be deleted once it is no longer necessary toprovide the service.

After Customer disables Webex
Assistant, User Information isdeleted within a week.
If you have paired with a device,
the relevant data is retained for 1
year.
Audio

Not retained

N/ATranscript

2 years

Transcripts are retained to evaluate and improve the service
and understand how the product is being used. Text
transcripts containing no personal data (e.g., “OK Webex, Starta Meeting”) will be de-identified and may be stored indefinitely.

Usage

Deleted within 1 year

Usage is retained to evaluate the service and understand how
the product is being used.

8. Personal Data Security

Cisco has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.
The table below summarizes encryption architecture of data stored specifically for the Webex Assistant for
Rooms.
Personal Data Category

Security controls and measures

User Information

Encrypted in transit, encrypted at rest

Audio

Encrypted in transit, no storage at rest

Transcript

Encrypted in transit, encrypted at rest

Usage

Encrypted in transit, encrypted at rest©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for theservice is below:
Sub-processor

Personal Data

Service Type

Location of Data
Center

Google Cloud
Google Cloud

Audio• Transcript• Usage• Transcript• Usage

Speech to text service
Cloud storage region

Worldwide
United States

Data analysis platform

United States

Splunk©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Addendum Five: Slido in Webex (Optional)
This Addendum to the Webex Meetings Privacy Data Sheet describes the processing of personal data (orpersonally identifiable information) by the Slido feature in Webex (“Slido,” “Slido in Webex,” or the “Service”).

1. Overview of Slido in Webex Meetings Capabilities

Slido in Webex is a cloud-based polling and Q&A solution aimed at B2B customers. Users stay engaged during
meetings by voting in live polls and asking questions. Slido is an integrated part of Webex Meetings or available
to hosts and meeting participants as a web application. For a detailed overview of the Service, please visit the
Slido in Webex website.

2. Personal Data Processing

Because of the nature of the Service, we do not expect any sensitive data to be sent through Slido.
The table below lists the personal data processed by Slido in Webex to provide its services and describes why
the data is processed.

Personal Data Category

Type of Personal Data

Purpose of Processing

Host Information•

Name, email address, organization ID

We use this data to:•
Provide the service (may include
support, maintenance, andprotection of the service)

Participant Information•

Name, email address, organization ID

We use this data to:•
Provide the service

User Generated Information•

Questions, polls, answers, ideas, chats any content shared or created byparticipants and hosts

We use this data to:•
Provide the service

User Technical Information•

Device data (e.g. hardware model,
operating system version, unique device
identifiers),
Log data (e.g. your search queries, details
about your connection such as IP address,
date, time, edge-location, ssl-protocol, sslcipher or time-taken to serve you requested
site, device event information such as
crashes, system activity, hardware settings,
browser type, browser language, the date
and time of your request and referral URL)
Location information (IP address)
Unique users IDs
browser local storage and application data

We use this user technical data:•
For the purposes of providing,tailoring and improvement of theservice••••©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco publiccachesCookies•

Support Information

We collect contact data of people reaching out
through Slido.com for support:•

Essential cookies collected throughembedded browser utilized in the WebexSlido interface

Usually name, email, company

We use cookies:•
To provide, tailor and improve
the service
We use contact data of people reachingout to us:•
Providing Support•
Tailoring and improvement of ourserviceTechnical Support Assistance

If a Customer reaches out to Cisco Technical Assistance Center (TAC) for problem diagnosis and resolution,
Cisco TAC may receive and process personal data from the Service. The Cisco TAC Service Delivery Privacy
Data Sheet describes Cisco’s processing of such data.

3. Data Center Locations

Cisco uses third-party infrastructure providers to deliver the service globally. Please see Section 8 for a list of
subprocessors, including infrastructure providers.
Data Center Locations
IrelandGermany

4. Cross-Border Data Transfer Mechanisms

Cisco has invested in transfer mechanisms to enable the lawful use of data across jurisdictions:••••Binding Corporate Rules (Controller)
APEC Cross-Border Privacy Rules
APEC Privacy Recognition for Processors
EU Standard Contractual Clauses

5. Access Control

The table below lists the personal data used by Slido in Webex to carry out the service, who can access thatdata, and why. Content you choose to share during an event may be accessed by users in the event, wherever
they are located. Even after you remove information from the Service, copies of that content may remain
viewable elsewhere to the extent it has been shared with others.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Personal Data Category

Who has accessPurpose of the access

Host Information

Host

View host profile data through slido.com

CustomerManage, delete user’s slido profiles through slido.com

Cisco

Provide the service

Host

View joined participants through slido.com

Cisco

Support the service in accordance with Cisco’s data
access and security controls

Customer

Delete participant content data by submitting privacy
request form

Host

View submitted User Generated Information throughslido.com

Cisco

Support the service in accordance with Cisco’ data
access and security controls.

Participant Information

User Generated
Information

Cisco will not access this data unless an authorization is
granted by the Customer, and will only access it inaccordance with Cisco’s data access and security controls.
User Technical Information

Cisco

Provide, tailor and improve the service

Cookies

Cisco

Provide, tailor and improve the service

Support Information

Cisco

Support Information is kept as part of record of service
delivery

6. Data Portability

Slido allows Customers and hosts to export event content data through slido.com.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

7. Data Deletion and Retention

The table below lists the personal data used by Slido, the length of time that data needs to be retained, andwhy we retain it.

Type of Personal Data

Retention Period

Reason for Retention

Host Information

Host Information is retained
until account termination.

•

Provide the service

Participant Information

Participant Information
associated with a specificmeeting is retained until
account termination.

•

Provide the service•

Provide the service

Technical Information

User Generated Information
associated with a specificmeeting can be deleted bydeleting all Slido dataassociated with that meeting.
As request must be submitted
through a privacy request.
Deleted 1 year after collection•

Technical Information is kept as part of Cisco’s record ofservice delivery, conduct analytics and measure statistical
performance.

Cookies

Maximum of one year•

To provide, tailor and improve the service

Support Information

Not deleted•

Support Information is kept as part of record of service
delivery.

User Generated
Information

Participant Information
associated with a specificmeeting can be deleted bydeleting all Slido dataassociated with that meeting.
As request must be submitted
through a privacy request.
User Generated Information
associated with a specificmeeting is retained until
account termination.

8. Personal Data Security

Slido has implemented appropriate technical and organizational measures designed to secure personal datafrom accidental loss and unauthorized access, use, alteration, and disclosure.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

Personal Data Category

Security controls and measures

Host Information

User Technical Information

Encrypted in transit and at rest
Encrypted in transit and at rest
Encrypted in transit and at rest
Encrypted in transit and at rest

Cookies

Encrypted in transit and at rest

Support Form Information

Encrypted in transit

Participant Information
User Generated Information

9. Sub-processors

Cisco partners with service providers that act as sub-processors and contract to provide the same level of dataprotection and information security that you can expect from Cisco. A current list of sub-processors for theservice is below:

Sub-processor

Personal Data

Service Type

Location of Data
CenterAmazon Web Services• Host Information• Participant Information• User-Generated
Information• User Technical
Information• Cookies• Support Information

Infrastructure as a Service

Dublin, IrelandFrankfurt, Germany

10. Information Security Incident Management
Breach and Incident Notification Processes

The Data Protection & Privacy team within Cisco’s Security & Trust Organization coordinates the Data Incident
Response Process and manages the enterprise-wide response to data-centric incidents. The Incident
Commander directs and coordinates Cisco’s response, leveraging diverse teams including the Cisco Product
Security Incident Response Team (PSIRT), the Cisco Security Incident Response Team (CSIRT), and theAdvanced Security Initiatives Group (ASIG).
PSIRT manages the receipt, investigation, and public reporting of security vulnerabilities related to Cisco
products and networks. The team works with Customers, independent security researchers, consultants,
industry organizations, and other vendors to identify possible security issues with Cisco products and networks.
The Cisco Security Center details the process for reporting security incidents.
The Cisco Notification Service allows Customers to subscribe and receive important Cisco product andtechnology information, including Cisco security advisories for critical and high severity security vulnerabilities.
This service allows Customers to choose the timing of notifications, and the notification delivery method (email
message or RSS feed). The level of access is determined by the subscriber's relationship with Cisco. If you
have questions or concerns about any product or security notifications, contact your Cisco sales representative.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022

Privacy Data Sheet

Doc type
Cisco public

11. Certifications and Compliance with Privacy Requirements

The Security & Trust Organization and Cisco Legal provide risk and compliance management and consultation
services to help drive security and regulatory compliance into the design of Cisco products and services. The
Service is built with privacy in mind and is designed so that it can be used in a manner consistent with global
privacy requirements.
In addition to the Cross-Border Data Transfer Mechanisms/Certifications listed in Section 4, Cisco has thefollowing:••

EU-US Privacy Shield Framework
Swiss-US Privacy Shield Framework

Further, in addition to complying with our stringent internal standards, Cisco also maintains third-party
validations to demonstrate our commitment to information security.
Slido in Webex currently holds the following privacy certifications:•

ISO27001

As part of its integration, Slido in Webex intends to pursue other privacy certifications, including those
associated with Webex.

12. Exercising Data Subject Rights

Users whose personal data is processed by the Service have the right to request access, rectification,suspension of processing, or deletion of the personal data processed by the Service.
We will confirm identification (typically with the email address associated with a Cisco account) before
responding to the request. If we cannot comply with the request, we will provide an explanation. Please note,users whose employer is the Customer/Controller, may be redirect to their employer for a response.
Requests can be made by submitting a request via:

1) the Cisco Privacy Request form
2) by postal mail:Chief Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAmericas Privacy Officer
Cisco Systems, Inc.
170 W. Tasman Drive
San Jose, CA 95134
UNITED STATESAPJC Privacy Officer
Cisco Systems, Inc.
Bldg 80, Lvl 25, Mapletree Biz
City,
80 Pasir Panjang Road,
Singapore, 117372
SINGAPORE©2022 Cisco and/or its affiliates. All rights reserved.

EMEAR Privacy Officer
Cisco Systems, Inc.
Haarlerbergweg 13-19, 1101 CH
Amsterdam-Zuidoost
NETHERLANDS

Version 5.0, February 2, 2022

Doc type
Cisco public

Privacy Data Sheet

We will endeavor to timely and satisfactorily respond to inquiries and requests. If a privacy concern related tothe personal data processed or transferred by Cisco remains unresolved, contact Cisco’s US-based third-party
dispute resolution provider. Alternatively, you can contact the data protection supervisory authority in yourjurisdiction for assistance. Cisco’s main establishment in the EU is in the Netherlands. As such, our EU leadauthority is the Dutch Autoritiet Persoonsgegevens.

©2022 Cisco and/or its affiliates. All rights reserved.

Version 5.0, February 2, 2022