MetricStream Privacy Policy
In this Privacy Policy, "MetricStream, ""us, ""we" and "our" refers to MetricStream, Inc. MetricStream is committed to protecting your privacy. This privacy policy explains MetricStream's data collection and use practices through its website. By accessing MetricStream’s website, you agree to the terms of this Privacy Policy. This policy does not override any terms directly established between you and MetricStream.
MetricStream International Compliance
This Privacy Policy also explains how we will store your information in the United States, in the European Economic Area (EEA), and in other locations outside of the EEA. Any transfer of your data to the United States or another location outside the European Economic Area will be in compliance with applicable European data protection laws and in respect of transfers to the United States.
Collection and Use of Information
Parts of this website may invite you to register for events, download white papers or literature, or obtain more information. MetricStream collects the email addresses of those who communicate via email, as well as information volunteered by consumers, such as in information requests and/or website registrations. Under no circumstances will any information provided to MetricStream be sold or rented to a third party without your prior consent. MetricStream may use your contact information to send you company and product information that you requested, and for marketing analysis of MetricStream's website traffic.
This website may use technology that lets MetricStream collect certain technical information, such as IP addresses, browser types, traffic patterns and the address of any referring websites and uses HTTP cookies for systems administration. However, if you do not wish to receive cookies, or want to be notified of when they are placed, you may set your web browser to do so, if your browser so permits.
MetricStream may monitor how a visitor arrives at website but cannot and will not gather information about other websites you have been on.
Use of Personal Information
MetricStream may use your personal information for the following purposes:
1. To make the website easier for you to use by entering your personal information only once;
2. To provide information to allow MetricStream to create and publish content most relevant to its customers; and
3. To alert its customers to product upgrades, special offers, updated information and other new products and services.
You may remove your name from any MetricStream distribution list by clicking on a link provided within each electronic communication, or by replying to the email with the subject line "unsubscribe."
If you supply MetricStream with your telephone number online, you may receive telephone contact from us with information regarding new products and services or upcoming events. If you do not wish to receive such telephone calls, please let us know by calling the telephone number below.
Links to Other Websites
MetricStream's website may provide links that can take you to other websites, which may include MetricStream's partner websites. You should review the privacy and other policies at third party websites you visit, since those websites are not bound by MetricStream's privacy policy, and MetricStream has no control over the content of these other websites, nor the usage of information they gather.
This Privacy Policy covers the privacy practices by MetricStream and does not cover the privacy practices of third-party websites or features. MetricStream is not responsible for the privacy policies and/or practices of third parties.
Legal Compliance
We reserve the right to access and disclose your information when we believe in good faith that such disclosure is necessary to: (a) enforce legal rights and comply with the law; (b) comply with an order from a government entity or other competent authority; (c) prevent or address potential or actual injury or interference with our rights, property, operations, users or others who may be harmed or may suffer loss or damage; and (d) protect our rights, prevent fraud and/or comply with judicial proceeding, court order, or legal process served on MetricStream.
Law Enforcement
Under certain circumstances, we may be required to disclose your information to government or law enforcement officials in response to a lawful request by a public authority or if we have to do so to comply with a legal obligation, including to meet national security or law enforcement requirements. We can also disclose your information in order to apply or enforce our terms and conditions or to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person or to prevent or prevent any illegal activity (including for the purposes of fraud protection and credit risk reduction).
You will be notified when any identifying information about you is collected or shared by any third party that is not our service provider, so you can make an informed choice as to whether to share your information with that party. If you do not wish to have your information shared and want to opt out from receiving further communications from any third party that is not our agent or service provider, please contact that third party directly.
Security
Protecting your privacy and your information is a top priority at MetricStream. MetricStream has taken appropriate measures to prevent the loss, misuse and alteration of your information. Once MetricStream receives information that is entered into its website, it is stored behind a firewall. All MetricStream employees are aware of the company's privacy and security policies. Your information is only accessible to those employees who need it in order to perform their jobs.
Accountability and Liability for Onward Transfer
MetricStream is required to take certain steps when transferring personal data received from the European Union to third parties (such as including contractual provisions in our third-party contracts which require them to provide the same level of protection and limiting their use of the data to the specified services provided on our behalf).
We take reasonable and appropriate steps to ensure that third parties process personal data in accordance EEA data privacy regulations and to stop and remediate any unauthorised processing. Under certain circumstances, we may remain liable for the acts of third parties who perform services on our behalf in connection with their handling of personal data that we transfer to them.
Privacy Complaints Handling, Recourse and Enforcement
MetricStream commits to resolve complaints about your privacy and our collection or use of your personal information (without any charge to you). European Union individuals with inquiries or complaints regarding this Privacy Policy should first contact us at: privacypolicy@metricstream.com.
We will respond to any complaints as soon as possible and within 45 days.
You may also refer a complaint to your local data protection authority and we will work with them to resolve your concerns.
Access to information
You have the right to access the personal data we collect about you in the EEA and to request that we correct, amend, or delete it if it is inaccurate or processed in violation of the EEA data privacy regulations. These access rights may not apply in some cases, including where we must comply with legal requirements or if providing access is unreasonably burdensome or expensive under the circumstances or where it would violate the rights of someone other than the individual requesting access.
If you would like to request access to, correction, or deletion of your personal data collected in the EEA, you can submit a written request using the contact information provided below. We may request specific information from you in order to confirm your identity. In some circumstances, we may charge a reasonable fee for access to your information.
Processing Information for our Customers and (“General Data Protection Regulation”) GDPR
Where we process personal information in connection with the provision of our software solutions to our enterprise customers, we only collect, process and store personal information to support and provide those solutions. We act as data processors on behalf of our customers and do not use such information for our own purposes. You should refer to the agreements governing your use of those solutions with such enterprises to find out more about how your data is being used by them.
MetricStream as Data Processor
MetricStream applications and Cloud Solutions provide Governance, Risk, and Compliance (GRC) systems of records to its customers. As a service provider to its customers, MetricStream applications may capture personal data (name, email address, contact info, company affiliation, etc.) to track the records entered into the system from an authentication and authorization perspective. In this capacity, MetricStream acts as a data processor on behalf of its customers. As a data processor, MetricStream has put in place appropriate technical and organizational measures to help ensure that its processing activities meet the requirements of GDPR, some of which we have described in this statement.
MetricStream has implemented various security measures including controls and application and network level security audits by third-parties as well as robust standard operating procedures to manage any security incident in collaboration with the customer.
MetricStream is committed to ensuring that it has data transfer and data management mechanisms in place as required by the GDPR. Further, as an ISO 27001 and SSAE 16 SOC 2 certified organization, MetricStream adheres to all necessary controls to protect customer data.
To comply with GDPR, Metric uses Standard Contractual Clauses (SCC) specified by GDPR when there is transfer of personal data outside of the EEA.
MetricStream Customers as Data Controller
MetricStream is working with its customers to enable them with specific capabilities within its applications to assist them in meeting their requirements. These measures include the following: Processing Records and Audit Trail: MetricStream applications are designed to assist customers with their record keeping and accountability obligations by providing audit trails for information changes within the system which captures the data flow and user navigation from login to logout.
Data Purge and Archiving: MetricStream applications are designed to provide capabilities to its customers to assist responding to requests by end users exercising their rights under GDPR. For example, MetricStream applications help its customer end users to find out where personal information is captured and used. If an end user asks for removal of their personal information (right-to-erasure) we will work with our customer to provide a solution while preserving the tenets of GRC. MetricStream will work with our customers to on a case-by-case basis using a data-change request.
Information Access Authorization Management: MetricStream applications are designed to provide customers with administrative access to manage user information along with user roles and responsibilities across the system.
Robust Incident Management Capability: MetricStream’s cloud team will work in collaboration with customers to institute robust GDPR compliant standard operating procedures for security breach related incidents
Contractual Obligations: MetricStream will work with customers to confirm appropriate data processing agreements are in place.
Brexit
MetricStream is monitoring the current developments with regards to UK Brexit and regulations that may arise. MetricStream anticipates there will minimal or no immediate impact to our Cloud (hosted) customers if there is a Brexit event, and any possible disruptions will governed by the standard terms of the Cloud Service Tier that customers have opted for.
Additional California Privacy Disclosures
Effective as of January 1, 2020
In this Additional California Privacy Disclosures supplement (“Supplement”), "MetricStream", "us", "we" and "our" refers to MetricStream, Inc.
MetricStream is committed to protecting your privacy. By accessing MetricStream’s websites, you agree to the terms of Privacy Policy posted at www.Metricstream.com. This Supplement provides additional privacy disclosures and informs you of your additional rights as a California resident, and should be read in conjunction with our Privacy Policy. The California Consumer Privacy Act (“CCPA”) gives you certain rights with respect to the processing of your personal information.
By availing yourself of the rights set forth below, you are declaring you are a California resident:
The Right to Know Your Personal Information
You have the right to request that we disclose personal information we collect, use, disclose and “sell” about you over the prior twelve (12) months. Under the CCPA, a “sale” means providing to a third-party personal information for valuable consideration. MetricStream does not sell your personal information. To make a verifiable request for information about the personal information we have collected about you, please email privacypolicy@MetricStream.com. We will not discriminate against you for exercising any of your rights under the CCPA.
Modifications
MetricStream may, in its discretion, alter or add to this Privacy Policy. You should check this part of MetricStream's website periodically to determine if there has been a change. If we make material changes to this Privacy Policy, we will notify you here, by email, or by means of a notice on our homepage.
General
This Privacy Policy reflects MetricStream's internal policies and procedures with respect to data privacy .
For more information on our privacy policies and procedures for our cloud products and applications please see our Privacy Statement for Cloud Solutions.
MetricStream Contact Information
Questions regarding this policy and any requests to access or modify data should be directed to our data privacy team at the following email address: privacypolicy@MetricStream.com Or you can phone, mail to:
MetricStream, Inc.
6201 America Center Drive,
Suite 240
San Jose, CA 95002
Phone: +1-650-620-2955
Toll Free Phone: 1-800-858-5658
Email: privacypolicy@metricstream.com
Third-Party Privacy and Cookies Disclosures
