Effective: January 19, 2021

Rimeto, an enterprise directory service brought to you by Slack Technologies, Inc. and its affiliates, (referred to in this policy as “Rimeto” or “we” or “our”) is committed to maintaining the trust of our customers. Please read this policy (the “Privacy Policy”) carefully to learn more about Rimeto’s privacy practices and policies with respect to Customer Data (defined below) that is collected and used through the Rimeto Internet application (the “Web App”), mobile application (the “Mobile App”), or administrative interface (collectively, the “Rimeto Service”). This Privacy Policy applies to “Personal Data,” which is Customer Data that is associated with an identified or identifiable natural person and is protected as personal data or personal information under applicable data protection law.

1. RIMETO IS A DATA PROCESSOR/SERVICE PROVIDER FOR ITS CUSTOMERS

Rimeto customers, and not Rimeto, determine how and why Personal Data submitted to the Rimeto Service is used, either by or at the direction of such customers. With respect to such Personal Data, (1) Rimeto is a “data processor” (“Data Processor”) under the EU General Data Protection Regulation (“GDPR”) and a “service provider” under the California Consumer Privacy Act (“CCPA”), and (2) Rimeto’s customers are the controllers under GDPR. (“Data Controller”). This Privacy Policy describes how Rimeto processes Personal Data as a Data Processor for the purpose of providing the Rimeto Service to our customers pursuant to the applicable data processing terms with those customers.

As Data Controllers, Rimeto’s customers are responsible for disclosing the rights of individuals (“Data Subjects”) with respect to their Personal Data and other information regarding the collection and use of that Personal Data, in accordance with the GDPR, CCPA, and other laws requiring such disclosures.

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy covers the processing of Personal Data that Rimeto performs as a Data Processor for and on behalf of its customers. Insofar as it acts as a Data Controller, Rimeto processes personal data in accordance with the Slack Privacy Policy.

3. PERSONAL DATA PROCESSED UNDER THIS POLICY

Rimeto acts as a Data Processor with respect to any Personal Data comprised in the Customer Data. By “Customer Data” we mean the content or information which individuals authorized by a customer submit to the Rimeto Service.

4. USE OF YOUR PERSONAL DATA

Rimeto uses the Personal Data to provide the Rimeto Service to our customers pursuant to the applicable data processing terms with those customers. This will include integration of the Rimeto Service with the other services provided by Slack Technologies, Inc. and its [affiliates](https://slack.com/affiliates).

5. DISCLOSING YOUR PERSONAL DATA

Rimeto does not disclose your Personal Data to third parties except where permitted or requested by our applicable customer, or where required by law.

No Sale of Personal Data Rimeto does not sell, rent or lease your Personal Data.

Service Providers Rimeto may disclose your Personal Data to our contracted service providers so that they can provide Rimeto with services, such as IT, system administration and hosting, and customer support.

Rimeto will, to the extent required by law and the applicable customer contract, obtain assurances before disclosing Personal Data to a subcontractor or third-party agent that the recipient will: (a) use the Personal Data only to assist Rimeto in providing, maintaining or improving the Rimeto Service, (b) provide at least the same level of protection for Personal Data as is required of Rimeto, and (c) notify Rimeto if the recipient is no longer able to provide the required protections. Upon notice, Rimeto will act promptly to endeavor to stop and remediate any unauthorized processing of Personal Data by the recipient. Rimeto will remain liable for onward transfers to its subcontractors and third-party agents.

A current list of the subprocessors that support the Rimeto Service can be found here. A list of the subprocessors that support Slack Technologies, Inc. and its affiliates more broadly can be found here.

6. SECURITY OF YOUR PERSONAL DATA

As specified in the data processing terms with the applicable Data Controller, Rimeto takes reasonable and appropriate measures to protect your Personal Data from loss, misuse, and inappropriate access. We use standard, industry-wide practices such as firewalls, encryption of Customer Data at rest and in transit, and (in certain areas) Secure Socket Layers (“SSL”) to protect your information. However, as effective as encryption technology is, no security system is impenetrable. Rimeto cannot guarantee the security of our databases, nor can we guarantee that information you supply won't be intercepted while being transmitted to Rimeto over the Internet.

7. DATA RETENTION

Storage periods depend on the data processing terms with our customers and their choices, type of Personal Data, purposes of its collection and processing, and applicable law.

8. CHILDREN

Rimeto does not direct the Rimeto Service and associated website at children. We do not knowingly collect Personal Data from children under the age of 16. If you are a parent or guardian and believe your child has provided us with Personal Data without your consent, please contact us at privacy@slack.com.

9. ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS

This section provides additional details about the personal information Rimeto collects and receives about California consumers and the rights afforded to such consumers under the California Consumer Privacy Act or “CCPA.”

For more details about the personal information Rimeto has collected over the last 12 months, including the categories of sources, please see PERSONAL DATA PROCESSED UNDER THIS POLICY in Section 3 above. Rimeto collects and receives this information for the business and commercial purposes described in USE OF YOUR PERSONAL DATA in Section 4 above. Rimeto discloses this information as described in DISCLOSING YOUR PERSONAL DATA in Section 5 above. Rimeto does not sell (as such term is defined in the CCPA) the personal information we collect (and will not sell it without providing a right to opt out). Please note that we do use third-party cookies for our advertising purposes as further described in the Slack Privacy Policy and our Cookie Policy.

Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights.

California consumers may make a request pursuant to their rights under the CCPA using our online form. We will verify your request and may request government identification or other information in order to do so. Consumers can also designate an authorized agent to exercise these rights on their behalf.

10. DATA SUBJECTS IN THE EU AND UK

Rights and requests

Data subjects in the EU and United Kingdom may have certain rights regarding the processing of their Personal Data. You can obtain information about the applicable rights and how to exercise them from the relevant customer that is the Data Controller of your Personal Data.

Access Within the scope of our authorization to do so, Rimeto will work with its customers, the Data Controllers, to support them in providing their Data Subjects access to their Personal Data that Rimeto holds on behalf of its customers.

Corrections Rimeto will take reasonable steps to enable individuals, in connection with its customers, to correct, amend, or delete Personal Data that is demonstrated to be inaccurate.

Questions and Other Requests If you have further questions about the collection, retention and use of your Personal Data, about your choices and rights regarding such collection, retention and use, or wish to exercise your rights under applicable law, you should contact the Rimeto customer that is the Data Controller of your Personal Data (this may be your employer). We will forward any such communications to our customer, provide you with contact information for the customer, and work with the customer to address your questions and/or facilitate your choices and rights as appropriate.

If you have questions about our role as a Data Processor, you can submit your questions or request using our online form.

Complaints Rimeto may be able to assist you in resolving any complaints about the collection or use of your Personal Data. We will forward your complaint to the relevant customer (often the employer associated with that account), which is the Data Controller of that Personal Data. You may wish to reach out to the Data Controller before contacting Rimeto, as the Data Controller may be in the best position to resolve your issue.

11. INTERNATIONAL DATA TRANSFERS

European Union Model Clauses Rimeto offers European Union Model Clauses, also known as Standard Contractual Clauses, to meet the adequacy and security requirements for our Customers that operate in the European Union and the United Kingdom, and other international transfers of personal data. To request a copy of our standard data processing addendum, incorporating Model Clauses, please contact us by e-mail at dpa@slack-corp.com.

E.U.-U.S. Privacy Shield While Rimeto remains self-certified under the E.U.-U.S. Privacy Shield, it is not currently relying on the framework for the transfer of personal data. Rimeto is also subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. To learn more about the Privacy Shield Program, please see http://www.privacyshield.gov/welcome.

12. CHANGES/UPDATES

Rimeto reserves the right to update or modify this Privacy Policy at any time without prior notice. Any updates will be posted on the Rimeto website.