Event Privacy Notice
Effective as of June 29, 2023.
Sawtooth Software Inc (hereinafter “Sawtooth,” “we, “us,” or similar) is a corporation with its headquarter office in the state of Utah, United States of America. We collect and process several categories of personal data from you as a user of the Sawtooth website (hereinafter the “Website”) and to all products and services offered by Sawtooth (collectively, “Sawtooth”, “Platform”, "we", "us," or "our") when you register for a conference, event, workshop, webinar, or other activities (each, an “event”). Insofar as General Data Protection Regulations (“GDPR”) in the European Economic Area (“EEA”) or United Kingdom (UK), California Consumer Privacy Act (“CCPA”), and California Privacy Rights Act (“CPRA”) apply, we are a data controller and processor with regard to the personal data we process, and we may be the data exporter and importer of the personal data transferred from an adequate country in the EEA or UK to the United States (“US”).
We take your privacy seriously and this privacy notice describes our practices regarding our collection and use of your personal data – such as what data we collect, why we collect it, what we do with it, and sets forth your privacy rights.
Please read this Event Privacy Notice to understand how we handle your personal information. In addition to the information you provide in connection with an event registration, if you use our Website for such registration, the Website collects certain information about which you can read in our Privacy Policy and our Cookie Policy.
1. PERSONAL DATA WE PROCESS ABOUT YOU
1.1 Event registration through our Platform
We use our Platform to collect personal data that you directly input into event registration forms as well as in any other page we set up as an event organizer, such as your name, title, email address, your employer’s name, and other transaction-related information. This data, except for cardholder information, is collected by us and we process it in the performance of a contract with you (the event registration) as well as in our legitimate interest to contact you for future similar events, as follows:
(a) Manage our event attendees;
(b) Contact you with regard to the event you have registered;
(c) Run statistics with regard to our event attendees;
(d) Improve our future events; or
(e) Contact you with regard to other events, activities, products and services offered by Sawtooth, which you are free to unsubscribe from at any time.
1.2 Event registration, participation, and related matters
In order to participate in certain of our in-person events, you may be issued a name tag that identifies the level of access that your registration grants you. You will be asked to show this name tag at the entry in the various areas of our events, as this is in our legitimate interest to manage the access to our events.
Where we provide food in our events, we may ask you about food allergies or other conditions, so that we adapt our menu accordingly. Providing this information is optional and we will only process it with your consent and at your request.
The information above is stored by us in accordance with our retention policy.
1.3 Speakers
If you are a speaker in our events, we may be processing your name, title, employer, employment history, education, as well as your presentation slides (if applicable), photos, and videos of you at our events. The presentation slides (if applicable), photos, and videos may be shared with our members through the channels we consider appropriate.
1.4 Photos and videos
If you have signed the consent form for us to take photos and videos of you and share them publicly knowing that our purpose is to publicize and archive our events internally and externally, Sawtooth or Sawtooth’s subcontractor will process your image and/or voice data.
As you know that photos published online may be saved, downloaded, or taken a screenshot by any third party’s devise, and videos may also be recorded via any third party’s camera, subsequent processing of the photos and videos taken by Sawtooth or Sawtooth’s subcontractor may occur elsewhere. Sawtooth has no control over such third-party actions or the subsequent processing. Thus, Sawtooth cannot be responsible for any subsequent processing of the published event photos or recordings. You may withdraw the consent at any time. Please email our event manager hannah@sawtoothsoftware.com if you wish to opt-in or opt-out of having your image being taken and recorded at an event or to delete an already published photo or recording.
1.5 Related services
During the registration process or thereafter you may ask us to book a hotel room with one of our event partners. If you ask us to do this, we will legally conclude a contract with the hotel in your name. In the performance of this contract, we will share your personal data, to the minimum extent necessary, with the hotel where we book your room. The data we provide to them includes your name, residence, email address, and other identification information the hotel may require. The processing of your data by the hotel is made in their capacity of data controller, subject to their own privacy policy.
1.6 Event sponsors marketing
In the event that you receive any promotional goods or a conference bag with various items provided by sponsors of the Event, this product placement is made without providing your personal data to the Event sponsors. Therefore, if you are interested in any products from the Event sponsors, please contact them directly.
2. HOW WE SHARE INFORMATION
We will disclose your personal data only for the purposes and to those third parties as described below. We will take appropriate steps to ensure that your personal data is processed, stored, and transferred according to applicable laws and regulations.
2.1 Disclosure to third parties
We will share the strictly necessary parts of your personal data, on a need-to-know basis with the following categories of third parties:
(a) Payment processors that process payments for event registrations. These platforms act as controllers with regard to your data collect most data directly from you and such personal data processing is subject to the third-party’s own privacy policy.
(b) Hotels where we book accommodation in your name if you request us to;
(c) Corporate affiliates of Sawtooth, such as Sawtooth Software UK Limited;
(d) Companies that provide products and services to us (processors and/or sub-processors) and are located in the US or, in the event of in-person events, in the countries where the events are held, such as:
(i) Third parties involved in organizing our events, client support or sales activities; and
(ii) Information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up, and disaster recovery and cybersecurity services.
(e) Other parties such as public authorities and institutions, accountants, auditors, lawyers, and other outside professional advisors located in the US, the UK, and any other country where our in-person event is held, where their activity requires such knowledge or where we are required by law to make such a disclosure.
(f) We will also disclose your personal information to third parties:
(i) If you request or authorize us to do so, such as by consenting to us sharing your contact information with Sawtooth members in connection with an event or with the event sponsors/exhibitors of an event;
(ii) To persons demonstrating legal authority to act on your behalf;
(iii) If we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government officials and as may be required to meet national security, law enforcement requirements, or prevent illegal activity;
(iv) To respond to any claims, to protect our rights or the rights of a third-party, to protect the safety of any person or to prevent any illegal activity; or
(v) To protect the rights, property, or safety of Sawtooth, our employees, customers, suppliers, visitors, or other persons.
(g) We, as well as some of these recipients, may use your data in countries which are outside of the European Economic Area. Please see Section 2 below for more detail on this aspect.
2.2 Restrictions on use of personal information by recipients
Any third-party processors with whom we choose to share your personal information pursuant to the above are limited (by law and by contract) in their ability to use your personal information for the specific purposes identified by us. We will always ensure that any third parties with whom we choose to share your personal information are subject to privacy and security obligations consistent with this Privacy Notice and applicable laws. However, for the avoidance of doubt, this cannot be applicable where the disclosure is not our decision, including where you request it.
Save as expressly detailed above, we will never share, sell, or license out the use of any of your personal information to any third party without notifying you and, if applicable, obtaining your consent.
3. PROVISIONS APPLICABLE FOR PERSONS IN THE EEA OR UK
3.1. Transfers of information outside of the European Union
Since we are an organization based in the US, we process your personal data outside of the European Union/EEA. Thus, your personal data will be stored in the US data center(s).
Where your personal data is transferred to other entities as mentioned in Section 2 above, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Notice, the Standard Contractual Clauses, and the UK Information Commissioner’s Office (ICO) or European Data Protection Board (EDPB)’s guidance.
Further details on the steps we take to protect your personal information in these cases is available from us on request by contacting our Data Protection Officer at privacy@sawtoothsoftware.com.
3.2 Your rights as a data subject in the EEA or UK
- Your right of access
You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. Your right to rectification
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
- Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing
You have the right to object to processing if we are able to process your information. However, processing your personal information is a necessity for performance of contract.
- Your right to data portability
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organization to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
You are not required to pay any charge for exercising your rights. We have one month to respond to you.
- PROVISIONS APPLICABLE FOR ATTENDEES FROM CALIFORNIA OR VIRGINIA
4.1. Rights of the consumers in California.
The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. This landmark law secures new privacy rights for California consumers, including:
- The right to know about the personal information a business collects about them and how it is used and shared;
- The right to delete personal information collected from them (with some exceptions);
- The right to opt-out of the sale or sharing of their personal information; and
- The right to non-discrimination for exercising their CCPA rights.
In November of 2020, California voters approved Proposition 24, the CPRA, which amended the CCPA and added new additional privacy protections that began on January 1, 2023. As of January 1, 2023, consumers have new rights in addition to those above, such as:
- The right to correct inaccurate personal information that a business has about them; and
- The right to limit the use and disclosure of sensitive personal information collected about them.
4.2. Rights of the consumers in Virginia.
- To confirm whether or not a controller is processing the consumer's personal data and to access such personal data;
- To correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data;
- To delete personal data provided by or obtained about the consumer;
- To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
- To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
- 5. SECURITY
We are committed to protecting personal information from loss, misuse, disclosure, alteration, unavailability, unauthorized access, and destruction and taking all reasonable precautions to safeguard the confidentiality of personal information, including through use of appropriate organizational and technical measures. Organizational measures include physical access controls to our premises, staff training, and locking physical files in filing cabinets. Technical measures include use of encryption, passwords for access to our systems, and use of anti-virus software.
In the course of provision of your personal data to us, your personal information may be transferred over the internet to the data center(s) in the US. Although we make every effort to protect the personal information which you provide to us, the transmission of information between you and us over the internet is not completely secure. As such, we cannot guarantee the security of your personal information transmitted to us over the internet and that any such transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorized access to it.
6. CHANGES TO OUR PRIVACY NOTICE
We reserve the right, at our discretion, to modify our privacy practices, update, and make changes to this privacy notice at any time. For this reason, we encourage you to refer to this privacy notice on an ongoing basis. This privacy notice is current as of the date which appears at the top of the document. We will treat your personal data in a manner consistent with the privacy notice under which it is collected.
7. CONTACT INFORMATION
Please direct your questions regarding the subject matter of data protection and any requests in the exercise of your legal rights to our Data Protection Officer at privacy@sawtoothsoftware.com.
We will investigate and attempt to resolve any request or concern regarding the use or disclosure of your personal information. If you are not satisfied with our reply and you are from the European Union, UK, California of the US, or Virginia of the US, you may also make a complaint to your local data protection authority.