EFFECTIVE: DEC 9, 2024
Very Good Security, Inc. (“VGS”, “we”, “us”, “our”) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. VGS has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. VGS has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov.
VGS may collect personal data from existing and prospective customers under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF). VGS may use this information to provide services to our customers, including processing service requests, negotiating contracts, processing payments, communicating with customers, providing promotional and marketing offers, providing customer support, detecting and preventing fraud, and complying with governmental, legislative, and regulatory requirements. VGS may be required to disclose an individual's personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.
When VGS Customers use our services, VGS may process personal information on behalf of the VGS Customer as the respective controller or processor in the respective region. VGS does not determine the data collected, stored, and transmitted by its customers nor how the data is classified, accessed, exchanged, or otherwise processed. VGS customers are solely responsible for complying with applicable laws and regulations and ensuring the personal information they control and process meets these requirements.
VGS has written agreements in place with our customers that define the services provided and VGS's obligations with respect to customer data. VGS provides services only at the direction of our customers in alignment with the written agreements.
VGS complies with the privacy principles as described below:
As described in VGS's Privacy Notice, VGS will provide timely and appropriate notice of the data we are collecting, how we will use it, and the types of third parties with whom we may share it. We will provide this notice by posting our Privacy Notice on our Website, or, if the changes are significant customers will be provided an updated notice via email.
VGS processes its Customer's client's data according to the terms of the written agreement between VGS and the Customer.
VGS offers customers the opportunity to choose to opt out of having personal data transferred to third parties for reasons not listed in our Privacy Notice or used for purposes beyond those for which the data were collected. VGS does not sell data.
VGS written agreements with Customers limits our ability to disclose personal information to third parties or to use personal information for purposes other than those specified in the contract. VGS will assist in putting individuals who directly contact us regarding exercise of choice in contact with the EU controller to provide a choice mechanism.
VGS shares data with third parties to facilitate various business processes. A full list of reasons VGS shares data can be found in the Privacy Notice in the section entitled “With Whom Does VGS Share Your Data?”. VGS only shares Personal Information required for the third party to perform its services, and they will not be authorized to use it for any other purpose, unless you have consented to such disclosure.
For the actions of third party agents VGS engages to process data on our behalf, VGS remains responsible and liable under the Data Privacy Framework Principles if a third party agent processes the personal data in a manner inconsistent with the Data Privacy Framework Principles, unless VGS proves that we are not responsible for the event giving rise to the damage.
As described in our Security Statement, VGS is committed to securing our customers' data. We include security terms in our third party contracts, and our hosting services have been assessed by third party auditors in accordance with both PCI-DSS and SOC2 Security Standards.
VGS Customers are responsible for implementing security measures appropriate to the nature and volume of data stored on or transferred to VGS's system.
VGS operates under contractual requirements governing data retention, accuracy and purposes of processing. When VGS does collect personal information, we will take reasonable measures to verify that the personal information we collect is relevant and reliable for its intended use, and that it is accurate, complete, and current. Contact privacy@verygoodsecurity.com.
VGS offers individuals from whom it directly collects information reasonable access to their Personal Information and will provide such individuals reasonable opportunity to correct, amend, or delete inaccurate information. Contact privacy@verygoodsecurity.com.
If contacted by one of our customers' clients, VGS will work with the EU controller to facilitate access through the Customer's access methods.
VGS is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), failure to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC. The FTC has the power to prohibit such misrepresentations through administrative orders or by seeking court orders.
VGS periodically assesses its Privacy Notice and Data Privacy Framework Notice to ensure that it is accurate, comprehensive, and prominently displayed. VGS is committed to ensuring that complaints are resolved in a timely manner, and we will investigate and attempt to resolve any complaints and disputes regarding the collection, use, and disclosure of Personal Information in accordance with the Privacy Principles.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, VGS commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact VGS at:
Very Good Security, Inc.
General Counsel
207 Powell Street, Ste 200
San Francisco, CA 94102
Or by email: privacy@verygoodsecurity.com
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, VGS commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.
If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction: