Last Updated: November 3, 2020
Data Protection Highlights
Thank you for using KnowBe4 products. These data protection highlights (”Highlights”) are intended to provide you with a few key highlights from our data protection notices and will tell you how KnowBe4, Inc. (“KnowBe4”, “we”, “our”, or “us”) uses Personal Data (as defined below) collected at this Site. Our data protection notices will provide you with more detail on KnowBe4’s global data protection practices.
What is Personal Data?
“Personal Data” means any personally identifiable information that can be linked back to you such as your name, address, date of birth, phone number, and email address.
How Does KnowBe4 Collect Personal Data?
We collect Personal Data when you visit our Site, submit information through our submission forms, contact us, send information to us directly, or upload information to our technology platforms. We also receive Personal Data collected by our affiliates, channel partners, service providers, and other third party providers.
How KnowBe4 Uses Personal Data
KnowBe4 uses Personal Data to respond to your inquiries, to provide marketing materials to you, to run our technology platform(s), to improve our services, for hiring/employment purposes, to comply with legal obligations, and as otherwise described in our data protection notice(s) and applicable agreements for services.
Your Rights
If you are not a customer or an end user:
If you are not a customer or an end user, please email privacy@knowbe4.com to access, amend, delete, rectify, withdraw consent, or object to the processing of your Personal Data. Our data protection notices have more information about these options.
If you are a customer or an end user:
If you are an end user and your organization uses the KnowBe4 platform, we recommend you reach out to your Account Owner (as defined in the Product Privacy Notice) to exercise your rights. You may also email privacy@knowbe4.com and we will reach out to your Account Owner for you. Please see our Product Privacy Notice for more information about these options.
Contact Us
If you would like more information on our data protection practices, you can review our full data protection notices contained on this Site.
Please direct any complaints, requests or inquiries to privacy@knowbe4.com. We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA or other applicable jurisdictions, you have the right to lodge a complaint with the competent supervisory authority.
Full Website Privacy Notice
Important Information
We at KnowBe4, Inc. are committed to protecting your data. The data protection practices set forth in this Product Privacy Notice (the “Product Privacy Notice”) are for technology platforms owned by KnowBe4, Inc. (“KnowBe4”, “we”, “our”, or “us”). This Product Privacy Notice tells you how KnowBe4 uses Personal Data collected on our technology platform(s). “Personal Data” means any personally
identifiable information such as your name, address, date of birth, phone number, and email address.
By using our technology platform(s), you are accepting the practices described in this Product Privacy Notice. If you do not agree with the data practices provided in this Product Privacy Notice, you should not use products and services provided by KnowBe4. We may make changes to this Product Privacy Notice at our sole discretion at any time. We will alert you if there is any material change to this Product Privacy notice.Your continued use of this Site after we make changes to the Product Privacy Notice is deemed to be acceptance of those changes.
For the avoidance of doubt, this Product Privacy Notice only applies to the extent we process Personal Data in the role of a processor on behalf of our customers. If you have executed a Data Protection Agreement with KnowBe4, the terms of such agreement will supersede this Product Privacy Notice.
What This Notice Covers:
This Product Privacy Notice applies to the processing of Personal Data collected by us when you:
Personal Data KnowBe4 Collects
The Personal Data that we collect directly from you includes the following:
○ We use common information-gathering tools, such as tools for collecting usage data, cookies, web beacons and similar technologies to automatically collect information that contain Personal Data from your computer or mobile device as you navigate our Site, use our services, or interact with emails we have sent to you.
How Personal Data is Collected
Personal Data is collected by KnowBe4 when it is shared by your organization’s account administrator (the “Account Admin”), at the discretion of your organization. Personal Data will also be requested from you through our products and services (i.e. technology platforms) by your Account Admin at your organization’s discretion. KnowBe4 collects the minimum information necessary to provide its products and services to you..
How We Use Your Personal Data
We collect and process your Personal Data for the purposes and on the legal bases identified in the following (where we act as a processor of your Personal Data):
Where we have entered into a contract:
Legitimate interest is the legal basis for processing the following:
KnowBe4 processes and discloses Personal Data when cooperating with appropriate regulatory and government authorities. When KnowBe4 processes Personal Data for this purpose, the legal bases for processing shall be for compliance with a legal obligation to which KnowBe4 is subject.
Cookies, web beacons and other tracking technologies on our products and services
KnowBe4 uses cookies and other tracking technologies when users interact with our products and services. Cookies are small text files that are placed on your computer by a website. Each one of these cookies contain an identification number, IP address, and the time and date last accessed. KnowBe4 does NOT use these cookies contained within our products and services for targeted advertising.
Below are the two types of cookies that are used on KnowBe4’s platform for its products and services.
Most browsers are set up to accept cookies. If you choose, you may refuse to accept cookies or set up your browser so that it notifies you when you receive a cookie.
Who Do We Share Personal Data With?
We use third-party businesses to provide products and perform specialized services for data processing. When we provide Personal Data to these businesses, they are not permitted to use the Personal Data for any reason outside of the scope for which we contracted them.
The ways in which we share your Personal Data include the following:
KnowBe4 reserves the right to disclose your Personal Data under the following conditions: (1) when permitted or required by law; (2) when trying to protect against or prevent actual or potential fraud or unauthorized transactions; or (3) when investigating suspected fraud which has already taken place.
Sale of Personal Data
KnowBe4 will never sell your Personal Data.
Account Admin(s)
As an Account Admin, your Personal Data will be used to communicate with you for support purposes or to follow up on requests made by you or another user of the console as well as your use for the services. An Account Admin owns the product or service and delivers the service to members of an organization. When you or your Account Admin uploads information (such as business email address) into our products and services, it has been done at the discretion of the organization that you or your Account Admin represent. The Account Admin’s organization is the “controller” of the Personal Data and KnowBe4 acts as a “processor” of the Personal Data. KnowBe4 is legally bound by the applicable terms for the products and services purchased, such as the KnowBe4 Terms of Service, other applicable agreements for services between KnowBe4 and your organization, and/or Data Processing Agreements to only process data as authorized by the agreement(s) and upon the instruction of the controller. If you have any detailed questions regarding these agreements, please contact your Account Admin or KnowBe4 directly and we will forward your request to your appropriate organizational contact.
Subject to legal and contractual requirements, you can refuse our collection of your data or withdraw consent to further collection. Your Personal Data will never be used outside of the scope for which KnowBe4 was contracted.
Opt Out
Since the products and services provided are at the request of your organization, you can contact your organization’s Account Admin to opt out of the products and services provided. Additionally, you can contact your Account Admin to make changes to your Personal Data. KnowBe4 does not
have control over how your organization uses your Personal Data for their purposes. You can also contact us to contact your organization on your behalf by emailing privacy@knowbe4.com.
International Transfers of Personal Data
Your Personal Data will be collected, transferred to, and stored by us in the United States or by our affiliates in other countries where we operate.In the event that your Personal Data is processed outside the European Economic Area (EEA), we will ensure that the recipient of your Personal Data offers and adequate level of protection by entering into an agreement to abide by Standard Contractual Clauses for the transfer of data as approved by the European Commission (Art. 46 GDPR), or another mechanism approved by the EU.
Data Security and Retention
Your Personal Data is kept secure. Only authorized employees, agents, and contractors (who have agreed to keep information secure and confidential) have access to this information. To provide our products and services, we use third party businesses (“Third Party” or “Third Parties”) to perform specialized services for data processing. When we provide data to these businesses, they are not permitted to use data outside of the scope for which we contracted them.
We (and our third-party service providers) use a variety of industry standard security measures to prevent unauthorized access, use, or disclosure of your Personal Data. These security measures consist of but are not limited to data encryption and physical security. No method of transmission or method of electronic storage over the internet is 100% secure. Therefore, while we strive to use
commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.
KnowBe4 will retain your Personal Data for the period necessary to fulfill the purpose outlined in this Product Privacy Notice or until you request its deletion, unless a longer retention period is required by applicable data privacy law.
We take reasonable steps to ensure that your Personal Data is accurate, complete, current, and otherwise reliable for its intended use. We will not process Personal Data in a way that is incompatible with the purposes for which it was collected. If your Personal Data has been disclosed to a third party, and it has been deemed incorrect by you, KnowBe4 will contact the Account Admin and will work with third parties (such as our subprocessors) to request a correction to the information.
If KnowBe4 obtains knowledge that one of our service providers or employees is in violation of this Product Privacy Notice, KnowBe4 will take commercially reasonable steps to prevent or stop the unauthorized use or disclosure of your Personal Data. KnowBe4 takes data privacy seriously. Therefore, we agree to take commercially reasonable measures to ensure the proper handling of your Personal Data by our employees and service providers.
Your Rights
You have certain rights relating to your Personal Data, subject to local data protection laws. Depending on the applicable laws and, in particular, if you are located in the EEA, these rights include:
How to exercise your rights
To exercise your rights, please contact us at privacy@knowbe4.com.
More Important Information
Protected Health Information, Payment Card Information and other Sensitive Information.
KnowBe4 does not need, nor does it request, any protected health information (“PHI”) governed by the Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”), nor does it need or request any non-public consumer personally identifiable information or financial information governed by the Gramm-Leach-Bliley Act (“GLBA”) or payment card information covered
by the Payment Card Industry Data Security Standards (“PCI DSS”) in order to provide its products and services. You should never disclose, or allow to be disclosed, PHI, information protected by PCI DSS or GLBA, or other sensitive information to KnowBe4. In the event that a user discloses such information (which would be a violation of this Product Privacy Notice), you, on behalf of your organization, acknowledge that KnowBe4 does not take steps to ensure its products are HIPAA or PCI compliant. All obligations of the aforementioned regulations remain solely with you, on behalf of your organization.
Visitors under the age of 16
Our Website and our technology platforms are not intended for persons under the age of 16. Thus, we do not intentionally gather Personal Data from visitors who are under the age of 16. If you are under the age of 16, please do not submit your Personal Data via our submission forms.
California Consumer Protection Act
This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or “CCPA.”
We do not provide services, or other items of value, as consideration for your, or your end users’, personal information protected by the CCPA.
You are responsible for ensuring your compliance with the requirements of the CCPA in your use of the services we provide to you and your own processing of personal information.
Here are a few things that KnowBe4 will NOT do with personal information in the scope of acting as a service provider, as defined by CCPA:
Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this personal information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.
California consumers may make a request pursuant to their rights under the CCPA by contacting us at privacy@knowbe4.com. We will verify your request using the information associated with your account, including email address. Consumers can also designate an authorized agent to exercise these rights on their behalf.
Contacting Us
To exercise your rights regarding your Personal Data, or if you have questions regarding this Product Privacy Notice or our data protection practices please send an email to privacy@knowbe4.com. Alternatively, you may send notice by way of mail at the address listed below:
KnowBe4, Inc.
33 N Garden Avenue, Suite 1200
Clearwater, FL 33755, USA
Attn: KnowBe4 Privacy Team
We are committed to working with you to obtain a fair resolution of any complaint or concern about your data. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA, you have the right to lodge a complaint with the competent supervisory authority
