What Personal Data We Collect

When we use the term “personal data” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. The term does not include aggregate or de-identified data that is maintained in a form that is not reasonably capable of being associated with or linked to an individual and does not apply to other information that is excluded from privacy protections under applicable data protection law.

We collect your personal data in three ways: (i) Personal Data You Provide, (ii) Automatically Collected Personal Data, and (iii) Personal Data from Third Parties. More detail is provided below.

Personal Data You Provide

• Information When You Contact Us or Interact with Us: We collect personal data that you provide when you contact or interact with us, such as your name, address, email address, and telephone number. We may collect other information to process your request properly, such as questions, comments, feedback or requests.

• Promotions and Products Interest: We collect personal data if you choose to participate in a survey, research, promotion, marketing campaign, free trials or evaluations of our products, webinars, community, help forums, or events conducted or sponsored by us. You may provide us with personal data such as your name, email address, and/or telephone number, employer name, your title, and audio or visual information.

• Purchase Information: When you make a purchase on our websites or with our staff, including the purchase of Zscaler products and services, we collect information about the purchase, such as contact information, items you have purchased, and professional information.

Automatically Collected Personal Data

• Cookies: We use cookies and similar technologies to monitor the usage of our website. For example, we use cookies to remember your language preferences and login information, as well as to analyze our website traffic patterns.

• Technical and Usage Information: We collect certain device and network connection information when you access and interact with our website. This information includes IP address, browser type, internet service provider, URLs of referring and exit pages, operating system, date and time stamp, information that you search for, locale and language preferences, identification numbers associated with your device, your mobile carrier, and system configuration information. Occasionally, we connect personal data gathered in our log files as necessary to improve our website. In such a case, we would treat the combined information in accordance with this Privacy Policy.

Personal Data from Third Parties

We obtain personal data from other sources, which we may combine with personal data we collect automatically or directly from you. We may receive the same categories of personal data as described above from the following third parties:

• Our Customers, and Other Users or Individuals Who Interact with Our Services: We may receive your personal data from our customers, and other users or individuals who interact with our services. This includes any information collected by us when your organization contacts us for support related to your organization’s use of our products, services, or events. In such instances, we will also collect information about the reason for the inquiry and any other information provided to us.

• Your Employer or Organization: If you interact with our services through your employer or organization, we may receive your personal data from them.

• Business Partners: We may receive your personal data from our business partners.

• Social Media: When you interact with our services through various social media networks, we may receive some information about you when permitted to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and including, but not limited to, your profile information, profile picture, gender, username, user ID, age range, language, and country. Individuals should always review and, if necessary, adjust their privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services.

• Service Providers: Our service providers that perform services on our behalf, such as survey and marketing providers, collect personal data and often share some or all of this data with us.

• Other Sources: We may also collect personal data about you that we do not otherwise have from, for example, publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.

How We Share Your Personal Data

We share your personal data with third parties, such as (i) Agents and Authorized Partners, (ii) Service Providers, (iii) Third Parties for Corporate Transactions, and (iv) Other Third Parties.

Agents and Authorized Partners

We provide limited personal data to certain authorized resellers of our products and other authorized technology partners to communicate information to you about our products and as part of events that we jointly host with such partners.

Service Providers

We provide your personal data to contractors, service providers, and other third parties to support our business, which are bound by obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.

Third Parties for Corporate Transactions

We may disclose your personal data to third parties (e.g., a buyer or other successor) in connection with a corporate transaction, such as a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal data held by us in the capacity of Data Controller is among the assets transferred.

Other Third Parties

We may access, preserve, and share your personal data with third parties when required by law or if we have good faith belief that it is necessary to:

• comply with applicable law, legal process or government requests, as consistent with international recognized standards;

• comply with a subpoena, court order, or legal process served on us;

• establish or exercise our legal rights or defend against legal claims; or

• protect the property, interests, or personal safety of our agents, employees, customers or the public.

Under such circumstances, we may be prohibited by law, court order, or other legal process from providing notice of the disclosure, and we reserve the right to not provide such notice in our sole discretion.

Our Legal Bases and How We Process Your Personal Data

We may only use your personal data when we have a legal basis to do so. We use different legal bases depending on the purpose of our processing activity. These legal bases are contractual necessity, legitimate interests (ours, yours, or those of another party), consent, compliance with a legal obligation, performing a task in the public interest, and protection of vital interests.

Here we explain the legal bases we rely on when we process your information. This section also describes why we use your information, how this information is processed, and the associated rights, which always includes the right to access your information. For more information on how to exercise any of your rights, see the “Your Rights and Choices” section in the Privacy Policy.

Contractual Necessity

If you enter into a contract with us or we take steps at your request prior to agreeing a contract, we may process your personal data when it is necessary to perform the contract. This means we may use your personal data for purposes such as to enable the delivery of our services, become our customer or partner, communicate with you about orders, and enforce our terms and policies.

Legitimate Interest

We use your personal data when this is necessary to achieve legitimate interests—whether belonging to us, you, or a third party—provided these interests are not outweighed by your interests or fundamental rights and freedoms. This includes, but is not limited to, the following processing activities: when we communicate, when you use our services, when managing our marketing list, and sharing personal data with other parties to run our business efficiently and securely.

Consent

We ask for your consent to access or use your personal data for specific purposes. If we do, you will be able to revoke your consent by contacting us. This includes, but is not limited to when you sign up for our newsletter or events, and request a demo.

Legal Obligation

We may use your personal data when it is necessary to comply with a legal obligation, such as bookkeeping, accounting, taxation, employment, and other business activities.

Your Rights and Choices

You have rights and choices when it comes to your personal data. Some of these rights apply generally, while others will only apply in certain circumstances. Depending on the scenario, these rights may be subject to some limitations provided by law.

• Right to access: You have the right to obtain information about the data stored about you, including certain information about the processing.

• Right to rectification: You have the right to demand the rectification of any incorrect or inaccurate personal data we hold with respect to you.

• Right to erasure: You have the right to have some or all your personal data erased.

• Right to restriction of processing: You have the right to have your data with processing restriction by satisfying prerequisites in the law (e.g., contesting the accuracy of your personal data).

• Right to withdraw consent: You are entitled to withdraw any declaration(s) of consent previously made and relating to the processing of your personal data with future effect. However, such withdrawal of consent does not affect the legitimacy of any processing operations previously executed.

• Right to data portability: You have the right to data portability in circumstances where we rely on contractual necessity or consent as our legal basis. This means that you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to share it with a third party.

• Right to object the processing: You have the right to object to the processing of your personal data in certain circumstances. This right applies when we are performing a task in the public interest, pursuing our legitimate interests or those of a third party, or when your data is processed for the purpose of facilitating scientific or historical research in certain circumstances.

Please note that you may not be able to benefit from all features of our website if you request the deletion of your personal data or object to or withdraw your consent to such processing.

To exercise any of the above rights, please contact us by following the instructions available in the section “Contact Us” in this Privacy Policy.

If you are not satisfied with how we have responded to any of your rights requests, you also have the right to lodge a complaint with your local supervisory authority.

Data Security and Retention

Security of your personal data is important to us. We maintain appropriate technical, administrative, and physical security measures that are designed to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. We regularly review our security measures to consider available new technologies and methods. If you have any questions about the security of your personal data, you can contact us.

We retain personal data for as long as necessary to provide our services and for the other purposes set out in this Privacy Policy. We also retain personal data when necessary to comply with contractual and legal obligations, when we have a legitimate interest to do so (e.g., improving and developing our business, and enhancing its safety, security, and stability), and for the exercise or defense of legal claims.

The retention periods will be different depending on the type of personal data and the purposes for which we use the personal data. If you have any questions about the retention of your personal data, you can contact us.

International Data Transfers

The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in to locations where we and our third-party service providers have operations.

In the event of a transfer, we ensure that the personal data is transferred to countries recognized as offering an adequate level of protection, or the transfer is made pursuant to appropriate safeguards, such as standard contractual clauses adopted by the European Commission. If you wish to inquire further about these safeguards used, please contact us.

Children’s Privacy

We do not knowingly collect personal data from children under 13. If you are under 13, do not use or provide any information on this website or provide any data about yourself to us. If we learn we have collected or received personal data from a child under 13 without verification of parental consent, we will delete that data. If you believe we might have any information from or about a child under 13, please contact us.