EXTREMECLOUD™ IQ PRIVACY POLICY

Last Modified: April 6, 2020

Extreme’s Data Practices for Our ExtremeCloud™ IQ Service

Extreme Networks, Inc. and our affiliates and subsidiaries (“Extreme,” “we” or “us”) take your privacy seriously. This ExtremeCloud IQ Privacy Policy (“Privacy Policy”) describes how we use and protect information that we obtain from and about our customers (“you” or “Customer”) and users of your networks (“Customer End Users”) with regard to the ExtremeCloud IQ Service (“Cloud Service”). Please carefully review this Privacy Policy so you can make an informed decision about accessing or using the Cloud Service.

In the course of using the Cloud Service, you may provide or make available to us personally identifiable information, which may include one or more of the following types of information from your individual users (such as administrators) and/or Customer End Users: name, company, job title, email address, postal mailing address, work/mobile telephone number, Internet Protocol (IP) address, media access control (MAC) address, user name, and/or geolocation (collectively, “Personal Information”).

By accessing or using the Cloud Service, you expressly consent to our use of Personal Information and our handling practices described in this Privacy Policy. If you do not want Personal Information to be used in the manner set forth in this Privacy Policy, please immediately stop your use of the Cloud Service. You may send any questions or requests concerning this Privacy Policy to privacyinquiries@extremenetworks.com.

Any Personal Information you provide or which may be available to us through your use of the Cloud Service is subject to the terms of this Privacy Policy, and the ExtremeCloud IQ Service Agreement or the ExtremeCloud IQ Trial Agreement (applicable if you are evaluating the Cloud Service).

For information about our privacy practices related to any portion of the ExtremeNetworks.com website, please see the website’s Privacy and Cookies Policy, which can be found at the footer on any ExtremeNetworks.com web page.

1. What Does This Privacy Policy Cover?
This Privacy Policy explains how we collect, maintain, use and disclose (including for commercial purposes), Personal Information and other information with respect to your access to and use of Cloud Service, including:

  • any software or services related to Cloud Service, including maintenance or support, we may provide, including services relating to user or data analytics;
  • the features and services available through the Cloud Service, including during your evaluation or “beta” testing of the Cloud Service; and
  • in conjunction with demonstrating, testing, validating or improving the security or performance of the Cloud Service, or with respect to additional features, functions or applications.

Please see the Appendix at the end of this Privacy Policy for a table summarizing the data collected about Customers and Customer End Users.

2. How Extreme Protects Information
Extreme uses commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of Personal Information. We cannot, however, ensure or warrant the security of any information you transmit to Extreme or that is accessible to us to use as provided in this Privacy Policy. This is not a guarantee that such information will not be accessed, disclosed, altered, or destroyed by breach of any of Extreme’s physical, technical, or managerial safeguards.

If Extreme learns of a security systems breach that affects your or your Customer End User’s Personal Information, we will provide notice as required by applicable law. We may also attempt to notify you electronically through the contact information that you last provided to Extreme so that you can take appropriate protective steps or as otherwise required by applicable law. Extreme may also post a notice on our Cloud Service portal.
a. Privacy Settings
Please be aware that no security measures are perfect or impenetrable. Additionally, Extreme cannot control the actions of other individuals with whom you may choose to share your  information. Further, even after information is removed from the Cloud Service, caching and archiving services may have saved that information and other users or third parties may have copied or stored the information available on ExtremeCloud IQ. This may include Personal Information. We do not guarantee that information transmitted to or available on, the Cloud  Service or accessed or collected through the Cloud Service will not be viewed by unauthorized persons.
b. Where We Store Your Information
The data that we collect from our Customers, including your Personal Information, may be transferred to, stored at, or processed from a location outside the jurisdiction in which you reside.  This means it may be transferred to countries that do not offer the same level of legal protection  as exists in your country of residence. Whenever we transfer your information outside of your country of residence, we will take steps to put into place adequate safeguards to treated Personal Information securely and in accordance with this Privacy Policy. You may contact us for a copy of  the safeguards that we have put in place.

For Customers located in countries where the General Data Protection Regulation (“GDPR”) is in  effect, Customer End User Personal Information will be maintained on cloud servers located in  the European Economic Area.
c. Data Retention
Extreme will retain Personal Information and Customer End User Information we collect or   access under this Privacy Policy, or process on your behalf, for as long as needed to provide the   Cloud Service to you, and will retain and use your Personal Information beyond that point, as necessary as permitted under this Policy or to comply with legal obligations, resolve disputes, and enforce our contractual relationships.

3. Information Extreme Collects About You for Our Own Purposes
a. User-Provided Information
When you register and set up an ExtremeIQ account and access and use the Cloud Service, you may provide or make available Personal Information to Extreme.
b. Automatically Collected Information
Some information is also automatically collected when you use the Cloud Service, such as your IP  address, MAC address, your operating system, your browser type, the address of a referring web  site, and/or cell or mobile device identifier, and information identifying actions you take within  ExtremeCloud IQ, and other information relating to your device or information identifying your  activity while using the Cloud Service.
4. The Ways Extreme Uses and Discloses Information About You
a. Our Use of Your Personal Information
Extreme may use Personal Information we collect to process your requests or transactions, to provide you with information or services you request, to inform you about other information, events, promotions, products or services we or our third-party authorized resellers, distributors, service providers, channel partners, provider of managed services or marketing providers  (“Partners”) or affiliates think will be of interest to you, to facilitate your use of, and our administration and operation of, the Cloud Service, to comply with Extreme’s legal and contractual obligations, and for the purpose for which we may reasonably understand the information was provided or made available by you.

For example, we or our Partners or affiliates may use the information we collect to:

  • send you a welcoming email to activate your use of the Cloud Service and to contact you about your use of the Cloud Service, to provide other services, products or information you request and to complete any transactions in connection therewith;
  • respond to your emails, submissions, comments, requests or complaints and provide you with support;
  • request feedback and to enable us to identify, develop, customize and improve the Cloud Service and other services and business offerings (including those of our Partners and affiliates);
  • Collect and analyze usage and performance data regarding the Cloud Service;
    contact you for marketing, informational, product development and promotional purposes; and
  • achieve the purpose for which we may reasonably understand the information was provided or made available to us.

We may link or merge together Personal Information you provide or make available to Extreme online with other Personal Information so that we may better understand your needs and inform you about our products or services and those of our Partners or affiliates. In addition, if we receive information from third parties, we may combine this information with the other Personal Information we maintain about you.

Extreme may use automatically collected information or Personal Information for a number of reasons related to the Cloud Service, including to: (a) remember your information, including for your future use of the Cloud Service; (b) provide customized third-party promotions, advertisements, content, and information; (c) monitor the effectiveness of third-party marketing campaigns; (d) monitor the effectiveness of the Cloud Service, including aggregate usage metrics such as total number of visitors and pages viewed; and (e) track your entries, submissions, transactions and status in any promotions or other activities.
b. Service Providers
Extreme may share your Personal Information with Extreme’s employees, agents and contractors for legitimate business reasons, including to companies that provide services to us, such as our outside contractors or agents who help us manage our information activities. However, these service providers may only use your Personal Information to provide us with a specific service in support of the Cloud Service and not for any other purpose.
c. Compliance with Laws and Law Enforcement
We may disclose Personal Information in the good faith belief that we are lawfully authorized or required to do so, or that doing so is reasonably necessary or appropriate to comply with the law or with legal process or authorities, respond to any claims, or to protect the rights, property or safety of the Cloud Service, our employees or the public, including without limitation disclosures intended to protect Extreme or Customers (including other customers) from fraudulent, abusive, inappropriate or unlawful use of the Cloud Service.
d. Deidentified Information
We or our third-party service providers may use your deidentified data for various purposes, including research or analysis of our customer demographics, and your use history, or monitoring or improving the Cloud Service’s performance.
e. Other Transfers
We may disclose or transfer information about you, including your Personal Information, to businesses controlling, controlled by, or under common control with us or to an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.

5. Choices You Have Regarding the Use of Your Personal Information
You may, of course, decline to share your Personal Information with Extreme, in which case you should immediately cease using the Cloud Service. If you register as an ExtremeCloud IQ customer of Extreme, you may update, correct, or delete your profile information and preferences at any time by emailing us at privacyinquiries@extremenetworks.com.

You may “opt out” of receiving email from us for promotional and marketing purposes by clicking on the unsubscribe link included at the bottom of our marketing emails. Opting out of receiving email sent for promotional and marketing purposes does not limit or affect our ability to send you service and account-related emails or to collect, access, use, disclose or transfer your Personal Information as otherwise described in this Privacy Policy.

To protect your privacy and security, we take reasonable steps to verify your identity before granting you account access or making corrections to your information. You are responsible for monitoring your privacy settings and maintaining the secrecy and security of your account information at all times.
a. Your California Privacy Rights
Under California Civil Code Section 1798.83, California residents are entitled to request whether a business has disclosed certain Personal Information to any third parties for the third parties’ direct marketing purposes. California residents who wish to request information about our compliance with this statute or who have questions more generally about this Privacy Policy and our privacy commitments should contact us at the address below.

6. Links to Other Websites and Apps
The Cloud Service may be linked to internet websites or apps operated by other companies. Some of these websites or apps may be co-branded with our name or logo, even though we do not operate or maintain them. Extreme may also permit other service providers, such as session monitoring, security monitoring, authentication services and tracking services, to utilize information we collect, including Personal Information.

7. Extreme Privacy Practices Applicable to Customer End Users
The following describe Extreme’s data practices that are applicable in instances where Extreme processes Customer End User’s Personal Information on behalf of Customers.
a. Data Processing
When Extreme collects, uses, shares, or otherwise uses Personal Information about Customer End Users on your behalf, that Personal Information is treated as belonging to you, with Extreme acting as a service provider or “data processor” to you, as a “controller” of that data. As between you and your Customer End User, it is your obligation to comply with relevant privacy and contractual obligations regarding your collection, use, and sharing of Personal Information, and to ensure that your instructions to Extreme with regard to processing of the Personal Information do not violate any applicable privacy laws or your contractual obligations. Extreme assumes no responsibility for your violation of any such law or obligation.

Extreme processes Customer End Users’ Personal Information on your behalf to provide you with the Cloud Services, which include providing analytics data, troubleshooting and maintenance, security functions, usage information, and other information or data for you to use for your business purposes.

You may also collect information about Customer End Users’ online activities when using your networks that are enabled with the Cloud Service. Depending on the nature of your business, you may also use the Cloud Service to collect and use information that is subject to regulation under applicable data protection, privacy, or security laws. This information is also subject to the privacy policies between you and your Customer End User.
b. Data Collection, Storage, Use, and Disclosure
Extreme does not collect, access, analyze, share, sell, or otherwise use or transfer any Customer End User Personal Information that it collects on behalf of any Customer except as needed by Extreme or its sub-processors to process the Personal Information, or unless you have chosen to participate in comparative analytics, (as described below in Deidentified Information).
i. Deidentified Information
If you have opted-in to the comparative analytics function of the Cloud Service, you are permitting Extreme to de-identify and aggregate Customer End User Personal Information to provide comparative analytics. Deidentified data is information about Customer End User’s usage of your network, which may include Personal Information, but in aggregate form or a form that a third party can no longer reasonably use to identify specifically any entity or individual. You may opt out of Extreme’s use of such deidentified Personal Information.
In addition, Extreme may extract deidentified or aggregated information from the Customer End User Personal Information for purposes of operating the Cloud Service, obtaining and using performance analytics, and improving and offering services within the Cloud Service.
ii. Data Storage
For Customers located in countries where GDPR is in effect, Customer End User Personal Information will be maintained on cloud servers located in the European Economic Area.
iii. Social Login
Extreme enables our Customers to allow Customer End Users to log into networks that are enabled using the Customer End Users’ social network login credentials. In these instances, Customer End Users will be provided with information from their social network about the implications of connecting to the network using their social network login credentials, and will have the opportunity to choose whether to provide certain information through the network enabled with the Cloud Services. This information may include the name, gender, birthday, contact information, login source, and other information relating to a user that the end user’s social networks may pass to the network under the terms of service for each social network and the end user’s individual privacy settings. Customer End Users should review their privacy settings for each of their social network accounts to determine what information may be provided to you. The information collected from social networks is used for user validation and verification and may also be used or combined with other data and shared or disclosed according to the terms of this Privacy Policy or the Customer’s privacy policy.
iv. Sub-Processors/Service Providers
Extreme may share Customer End Users’ Personal Information with Extreme’s employees, agents and contractors for legitimate business reasons, including to companies that provide services to us, such as our outside contractors or agents who help us manage our information activities. However, these service providers may only use Customer End Users’ Personal Information to provide us with a specific service or services in support of the Cloud Service and not for any other purpose.
v. Compliance with Laws and Law Enforcement
We may disclose Personal Information in the good faith belief that we are lawfully authorized or required to do so, or that doing so is reasonably necessary or appropriate to comply with the law or with legal process or authorities, respond to any claims, or to protect the rights, property or safety of the Cloud Service, our employees or the public, including without limitation disclosures intended to protect Extreme or Customers (including other customers) from fraudulent, abusive, inappropriate or unlawful use of the Cloud Service.
vi. Other Transfers
We may disclose or transfer information about you, including Customer End User Personal Information, to businesses controlling, controlled by, or under common control with us or to an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
8. Information for European Residents
If you are located in the European Economic Area, we process Personal Information relying on the following legal bases:
To fulfill our contractual obligations under an existing agreement with you or in anticipation of entering into an agreement with you, including:

  • To carry out our obligations arising from any contracts or transactions entered or contemplated to be entered into between you and us, or to provide you with the Cloud Service and any services requested by you;
  • To notify you about changes to the Cloud Service;
  • To provide you with educational materials, webinars and training that you request;
  • To assist you in finding a Partner so that you can order product and services for your company;
  • To fulfill orders and provide you with products and services you have requested and/or paid for;
  • To enforce your legal rights under an agreement; and
  • To provide you with an estimate for our products or services.
  • To meet and fulfill our legitimate business interests, including:

    To communicate with you about your account, the Cloud Service, our products and services, and Extreme;
  • To manage our business needs, such as monitoring, analyzing, modifying and improving the Services’ and Products’ functionality and performance;
  • To prevent fraud and abuse on and unauthorized access to the Cloud Service;
    To provide you with information about products and services you have purchased or indicated your interest in or that we think you would be interested in;
  • To determine which features and functionality of the Cloud Service that customers like best to help us operate, enhance and improve the Cloud Service;
  • To grow our business;
  • To ensure that content from the Cloud Service is presented in the most effective manner for you and your computer;
  • To get to know our potential and existing clients, consumers, and customers;
  • To identify relevant content shared with potential and current customers; and
  • For any specific purpose for which it was provided or volunteered.

To comply with our regulatory and legal obligations or to enforce our legal rights, including:

  • As may be required by law to which we are subject and in accordance with GDPR;
  • To meet reporting requirements (e.g. filing tax forms);
  • To retain documents and information related to a legal action;
  • To enforce our Terms of Service and other terms; and
  • To report data breaches or unauthorized access to the Cloud Service.

With your consent, including:

  • To develop, market, sell or provide products and services;
  • To provide you with educational materials, webinars and training that you request;
  • To send you information about our or our Partners’ products or services. Sometimes, where you have shown interest in a particular product, our Partners may contact you directly;
  • To send you notices (for example, in the form of e-mails, SMS, mailings, and the like), and otherwise correspond with you, about products, services, companies, and events, sponsored by us and others, that we think might interest you, where you have consented to be contacted for such purposes;
  • To grow our business;
  • To get to know our potential and existing clients, consumers, and customers;
  • To identify relevant content shared with potential and current customers;
  • To provide you with information about our products and services;
  • To target personalized advertising to you on other websites.

If you reside in the European Economic Area, you may have certain rights with respect to the personal data you provided to us. To the extent permitted by applicable data protection laws, you may:

  • Access or modify your Personal Information;
  • Request that your Personal Information be erased if it is no longer necessary for the purposes for which it was processed, you have withdrawn consent to or object to the processing of such personal data and we meet no other legitimate basis for such processing or it has been unlawfully processed;
  • Restrict the processing of your personal data if you contest its accuracy or the lawfulness of our processing, we no longer need it but you need it for a legal claim or you have objected to its processing and await verification of our legitimate grounds for processing;
  • Under certain circumstances, have your personal data transferred to another company; or
  • Withdraw any consents that you have previously provided to allow us to process your personal data.

If you wish to exercise any of these rights please contact us at privacyinquiries@extremenetworks.com. Please note that some requests may require you to verify your identity. Although we urge you to contact us to find a solution for every concern you may have, you always have the right to lodge a complaint with your competent data protection authority.

9. Changes and Updates to This Privacy Policy
This Privacy Policy may be revised periodically without further notice to you and any such modification will be reflected by a “Last Modified” date above. We may not notify you of any changes to this Privacy Policy except by posting a new Privacy Policy at https://www.extremenetworks.com/company/legal/data-privacy-and-protection/. (Please revisit the aforementioned web page to stay aware of any changes). In the event that the modifications materially alter your rights or our obligations hereunder, we will make reasonable efforts to notify you of the change. For example, we may send a message to your email address, if we have one on file, or generate a pop-up or similar notification when you access our Cloud Service for the first time after such material changes are made. Your continued use of the Cloud Service after the revised Privacy Policy has become effective indicates that you have read, understood and agreed to the current version of the Privacy Policy.

10. Extreme Contact Information
Please contact Extreme with any questions or comments about this Privacy Policy, your Personal Information, our third-party disclosure practices, your consent choices, or to exercise your privacy rights, by email at privacyinquiries@extremenetworks.com or by mail at:

Attention: Legal Department
Extreme Networks
6480 Via Del Oro
San Jose, CA 95119
________________________________________
“ExtremeCloud” is a trademark of Extreme Networks, Inc. All rights reserved.

Appendix

Data Category
Types of Potential Personal Information CollectedPersonal Information SourceExtreme uses for Personal Information
Administrators (information we collect about you, the Customer)• Login Name (email address)
• First and Last Name
• Display Name
• Phone Number
• Job Title
• Admin Alternate Email Address
• Time Zone
• Locale
• Country
• Street Address
• City
• State / Province
• Postal Code / ZIP Code
• User ID
Information entered by Administrator when creating the accountExtremeCloud IQ account support, allow administrators to access.
Wireless Clients• Client Host Name
• Client MAC Address
• Client IP Address
• Client IPV6 Address
• Client OS Name
• User Name
• User Profile Name
Access Points, Branch routers with built-in wireless(1) Provide wireless services to the Wireless Client. (2) Provide Analytics data to ExtremeCloud IQ Customer.
Wired Clients• Client Host Name
• Client MAC Address
• Client IP Address
• Client IPV6 Address
• Client OS Name
Switches, Access Points, Branch routers.(1) Provide wired services to the Wireless Client. (2) Provide analytics data to ExtremeCloud IQ Customer.
Social Login Clients
(in addition to Wireless Client)
• Client MAC
• AP MAC
• SSID
• ID Provider (e.g., Google, Facebook, or LinkedIn)
• Owner ID
• Email address
Access Points, Branch routers with built-in wireless, and
Cloud Captive Web Portal
Support social login
Passerby Client
• Client MAC AddressAccess Points, Branch routers with built-in wireless Support Analytics data of passerby traffic to respective ExtremeCloud IQ Customers