SolarWinds Corporation US, SolarWinds Worldwide, LLC, SolarWinds Software Europe DAC and our affiliated companies and subsidiaries (“SolarWinds,” “we,” “us” or “our”) recognize the importance of privacy, security, and transparency.

References to “Personal Data” in this Privacy Notice means information that identifies or relates to an identifiable individual or is linked or reasonably linkable to an identifiable individual.

In this Privacy Notice, we explain how we collect, use, and disclose Personal Data as a “controller” or a “business” and the choices individuals have regarding their Personal Data. We also explain your rights as a data subject (or consumer) and how to get in touch with us regarding our processing of your Personal Data.

Further information about SolarWinds’ efforts and commitment to data privacy and security can be found on the SolarWinds Trust Center. For a list of our affiliated companies please refer to the Processor, Sub-Processor and Material Subcontractors Lists.

SolarWinds collects Personal Data as part of its normal business operations and in the administration of customer relationships. “Customers” include our customers and visitors to the SolarWinds website(s) and social media properties, our business partners and vendors, and individuals who register to use our products and Services, or to attend corporate events.

This Privacy Notice applies to and describes the Personal Data that we collect as a “data controller” or a “business,” including the Personal Data that we collect about:

• Visitors of the SolarWinds website(s) and our social media properties;
• Business partners and vendors;
• Individuals who register to use our products and Services;
• Individuals who register for or attend our webinars, conferences, and other events; or
• Other individuals who communicate or interact with us about our products, Services, or business, both online (including via email and our chatbot) and offline.

This Privacy Notice does not apply to the Personal Data that we collect and process about employees, applicants and contractors; different privacy notices apply to those data sets. Please reach out to your SolarWinds contact if you wish to request copies of those.

Further, this Privacy Notice does not apply to the Personal Data that we receive, process or store on behalf of Customers of our SaaS based products (“Customer Data”), as further explained below.

For our SaaS based products, we are a “processor” or “service provider” for Customer Data and process Customer Data on behalf of and in accordance with the instructions of our Customers, who are the “controllers” or “businesses” for their respective Customer Data. Customer Data is owned and controlled by our Customers. Customer Data may include information from the end points and other systems, tools, or devices that Customers manage or monitor using our Services, and end user data related to activities on the relevant networks and systems. It may also include event logs, end user information (such as IP address, email address and computer name), and other Personal Data, where relevant. Our Customers’ respective privacy policies apply to and govern the processing of Customer Data, not this Privacy Notice. For privacy information related to Customer Data, please reach out to the Customer directly. Our Customers’ privacy and security practices are their own and differ from those set forth in this Privacy Notice.

For SolarWinds products used in an on-premises deployment, behind the Customer’s firewall, the Customer is in control of their own product data. By keeping their software and product data on their infrastructure, our customers can decide how, where, and under which conditions their data is stored. To the extent that the information the customer chooses to share with SolarWinds constitutes Personal Data, that Personal Data is processed in accordance with this Privacy Notice.

The Personal Data we collect, and how we use it, varies depending upon the nature of our relationship and interactions with you. We collect the following types of Personal Data:

• Identifiers: includes direct identifiers, such as name, username, account name, address, phone number, email address, online identifiers, IP address, or other similar identifiers.
• Customer records: includes Personal Data, such as name, signature, contact information, and payment information that individuals provide us in order to purchase or obtain our products and Services. We may also collect billing address, financial accounts, credit card information, order details, subscription and license information, and usage details. In addition, we collect user credentials and profile data (name, contact, authorized users).
• Customer Support and Service information: when Customers contact us for support or other customer service requests, we maintain support tickets and other records related to the requests. We may also collect call recordings related to support and customer service-related calls.
• Commercial information: includes records, products, or Services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
• Usage details: we collect information about Customers’ usage of our Services, including IP address, Customer ID, email address, domain, date time and duration of visits to our websites, page visits, information about your computer or device including browser type, and other usage statistics, such as browsing history, clickstream data, search history, access logs, and other usage data and information regarding an individual’s interaction with our websites and Services, our marketing emails and online ads.
• Geolocation data: includes location information about a particular individual or device, or approximate location derived from IP address.
• Audio, video and electronic data: includes audio, electronic, visual, or similar information, such as CCTV footage (e.g., collected from visitors to our offices) and call recordings (e.g. of Customer support calls).
• Professional information: includes professional and employment-related information, such as current and former employer(s) and position(s) and business contact information.
• Visitor and event information: includes dietary restrictions, travel and accommodation details, issued identification pass to access premises and other details that you share with us when you attend an event or conference.
• Inferences: includes inferences drawn from Personal Data that we collect to create a profile reflecting an individual’s preferences, behavior, or other characteristics. For example, we may analyze Personal Data in order to identify the offers and information that may be most relevant to Customers, so that we can better reach them with relevant offers and ads.

We need to collect Personal Data to provide requested Services to you. If you do not provide the information requested, we may not be able to provide the Services. If you disclose any Personal Data relating to other people to us or to our service providers, you represent that you have the authority to do so and to permit us to use the data in accordance with this Privacy Notice.

Certain laws, require that we inform you of the purposes for using your Personal Data. The following table explains why we process particular categories of Personal Data.

We rely on the following reasons to process Personal Data for the purposes set out above:

• Legitimate Interests. In all cases where legitimate interests are relied upon as a lawful basis where permitted by applicable law, we take steps to ensure that our legitimate interests are not outweighed by any prejudice to your rights and freedoms. This is achieved in a number of ways, including the application of principles of data minimization and security, and by taking steps to ensure that Personal Data is collected only where it is relevant and is reasonably necessary for the legitimate purposes for which we use it.
• Compliance with a legal obligation. As outlined above, we may process Personal Data to comply with a legal obligation including, for example, to access, preserve or disclose certain information if there is a valid legal request.
• Consent. We process Personal Data based on your consent, which you may withdraw at any time.
• Performance of a contract. We process Personal Data where necessary to perform a contract with you and to provide the Services.
• Vital interests. In certain cases, we process Personal Data to protect an individual’s vital interests, such as when we need to preserve the safety of our personnel and visitors.

EEA/UK Residents. If you are in the EEA or UK, please review the section Additional Information for EEA/UK Users for more information about the legal bases we rely on for our processing activities.

California Residents. If you are a California resident, please be sure to review the section Additional Information for California Residents below for important information about our privacy practices and your rights under California privacy laws.

SolarWinds collects Personal Data through its normal business operations and in the administration of Customer relationships, which include:

• Data Submitted on Websites. In order to enjoy the full functionality of the websites or to conduct business with us, you may be prompted to provide certain Personal Data to us:
• By interacting with our websites, such as interacting with our chatbot or filling in forms (for example, a “Contact Us” form), at a trade show, or anywhere else we conduct business;
• By downloading or accessing the SolarWinds Services;
• By downloading documentation from our websites;
• By subscribing to newsletters or other communications; or
• By corresponding with us by phone, e-mail, or otherwise using our contact details. Typically, Personal Data includes name, business affiliation, business address, telephone number, and email address, and any other personal details provided or required to resolve inquiries or complaints.
• Customer Support and Service. When Customers contact us for support or other customer service requests, we maintain support tickets and other records related to the requests. We may also collect call recordings related to support and customer service-related calls.
• Business Contact and Customer Relationship Management. We collect and maintain information about our Customers, including from social networks, which may include company name, business contact name and title, phone number, email, and other contact details. We may also collect billing address, financial account, credit card information, order details, subscription and license information, and usage details. In addition, we collect user credential and profile data (name, contact, authorized users).
• Usage Details. We collect information about Customers’ usage of our Services, including IP address, Customer ID, email address, and other usage statistics. We do not collect usage details about Customer end users, except as necessary to provide and support the Services requested by Customers. When you visit our websites, our server automatically collects certain browser or device-generated information, which may in some cases constitute Personal Data, including but not limited to:
• Your domain;
• Your IP address;
• The date, time, and duration of your visit;
• Your browser type;
• Your operating system;
• Your page visits;
• Information from third parties;
• Other information about your computer or device; or
• Internet traffic.
• Third Parties. We also obtain Personal Data about Customers from third parties unless prohibited by applicable law, including third parties from whom we have purchased Personal Data, public databases, resellers, channel partners, and marketing partners. We combine this information with Personal Data provided by you. This helps us to update, expand, and analyze our records, identify new customers, and create more tailored advertising to provide Services that may be of interest to you.
• Cookies. Our websites use cookies and similar technologies. More information about our use of cookies and similar technologies can be found in our Cookie Policy here: https://www.solarwinds.com/cookies.
• Aggregate and De-identified Data. We may de-identify and aggregate Personal Data we collect such that the data no longer identifies or can be linked to a particular Customer or an individual data subject (“De-Identified Data”), subject to the terms of any applicable customer agreements. We may use this De-Identified Data to improve our Services, analyze trends, publish market research, and for other marketing, research, or statistical purposes, and may disclose such data to third parties for these specific purposes.

Other Data. SolarWinds collects, uses and maintains certain other data related to its business and the Services it provides to Customers, which is not Personal Data; this Privacy Notice does not restrict our use and processing of such data.

SolarWinds is a global group of companies, and we share Personal Data with our affiliated businesses as part of our business operations and administration of the Services. We may also appoint third-party service providers to assist us in providing information, products or Services to you, in conducting and managing our business, or in managing and improving our Services or the websites. SolarWinds may share your Personal Data with these affiliates and third parties to perform Services on SolarWinds’s behalf. In general, we disclose Personal Data as follows:

• Customers: if you use, access or communicate with us about our Services on behalf of your company (our Customer), we may share Personal Data about your access, and your communications or requests, with the relevant Customer.
• Service providers: to third-party service providers who perform functions on our behalf, including providing services such as website hosting, fraud prevention, marketing, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services in order to administer and improve the Services, secure our systems, host events and conferences and to facilitate our compliance with laws.
• Advertising and analytics partners: to third parties we engage to provide advertising, campaign measurement, data analytics, and related services to us (with your consent, where required by applicable laws).
• Business partners: to event co-sponsors and third parties in connection with licensing, joint development or other arrangements.
• Professional advisors: such as accountants, actuaries, experts, consultants, lawyers, banks and financial institutions in order to provide and improve the Services or for legal and compliance purposes, including to prevent fraud.
• In response to legal process: to law enforcement, public, regulatory and government authorities, courts, or tribunals, in order to comply with the law, judicial proceedings, a court order, or other legal process, such as in response to a subpoena or a request from public or government authorities (including authorities outside your country or region of residence), to enforce our terms and conditions, and other legal and compliance purposes.
• To protect our rights: to third parties where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of the SolarWinds Terms of Use or this Policy, to respond to claims asserted against us, or as evidence in litigation in which we are involved.
• Business transfers: as part of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings), including related to due diligence conducted prior to such event where permitted by law. Where required by applicable law, you will be notified of any such business transaction and of possible changes to the processing of your Personal Data in accordance with applicable law and the “Changes to Our Privacy Notice” section.
• De-identified Data: We also may share De-Identified Data with third parties for research, analytics, and other purposes, provided such information does not identify an individual.

Note that by using our Services, including interacting with our social media properties, you may elect to disclose Personal Data on message boards, chat, profile pages, blogs and other services to which you are able to post information and content. Please note that any information you post or disclose in this context will become public and may be available to other users and the general public.

Your Personal Data may be stored and processed in any country or region where we have facilities or in which we engage service providers. You understand that SolarWinds and our service providers may transfer your Personal Data to, or access it in, jurisdictions that do not include equivalent levels of data protection as your home jurisdiction. This includes the United States and other jurisdictions where we, our affiliates, and service providers have operations. In addition, our subprocessors are located around the world, as described in our subprocessor list. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries or regions may be entitled to access your Personal Data.

As required by applicable law, we implement safeguards to protect your Personal Data when we transfer it outside your country or region of residence, including through appropriate written data processing terms and/or data transfer agreements.

Individuals in the European Economic Area (EEA) and United Kingdom (UK). For transfers from within the EEA and/or UK to outside the EEA and/or UK, we ensure a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is implemented:

• Adequacy Decisions: Some countries outside of the EEA and the UK are recognized as providing an adequate level of data protection (the full list of these “adequate countries” for the EEA is available here and for the UK the list is available here).
• For transfers from the EEA and/or the UK to countries not considered adequate, we have put in place adequate measures, such as standard contractual clauses adopted by the relevant authority, to protect your Personal Data. (The form for the standard contractual clauses as approved by the European Commission can be viewed here).

To obtain additional details of the mechanism under which your Personal Data is transferred outside of the EEA or UK, you may request such details by contacting privacy@SolarWinds.com.

We use third-party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use our website, Services, and other websites or online services. You may receive advertisements based on information relating to your access to and use of our website, Services, and other websites or online services on any of your devices, as well as on information received from third parties. These companies place or recognize a unique cookie on your browser (including through the use of pixel tags). They also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop.

If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Notice, please visit http://optout.aboutads.info/#/ and http://optout.networkadvertising.org/#/.

We generally keep Personal Data for as long as necessary to fulfill the purposes for which it was collected as outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide Services to you (for example, for as long as you have a relationship with us or keep using our Services);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of matter files or communications for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Where we are subject to a legal obligation or retention is recommend in light of our legal position, we will retain certain Personal Data even after we no longer provide the Services to you, for example:

• To cooperate with law enforcement or public, regulatory and government authorities: If we receive a preservation order or search warrant, related to your Services account, we will preserve Personal Data subject to such order or warrant after you delete your Services account.
• To comply with legal requirements: We may retain your Personal Data as required by tax law and to comply with bookkeeping requirements.
• To pursue or defend a legal action: We may retain relevant Personal Data in the event of a legal claim or complaint, including regulatory investigations or legal proceedings about a claim related to your Personal Data, or if we reasonably believe there is a prospect of litigation.

In this section, we describe the rights and choices you have regarding your Personal Data. You may submit a request to exercise your rights in respect of your Personal Data to us here. We will respond to your request consistent with applicable law. For your protection, we may need to verify your identity before implementing your request.

If you would like to submit a request relating to Customer Data, you should contact the relevant Customer directly; if you submit a request to us related to Customer Data, we will forward your request to the relevant Customer (where known) so that they may respond to your request.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you make a purchase, you may not be able to change or delete the Personal Data provided until after the completion of such purchase). Further, certain Personal Data may be exempt from requests pursuant to applicable data protection laws or other laws and regulations.

Requests. If you would like to request to access, review, correct, update, suppress/delete, object to, restrict or opt out of the processing of Personal Data, withdraw your consent where relied upon for processing (which will not affect the lawfulness of processing prior to the withdrawal), or if you would like to request to receive an electronic copy of your Personal Data for the purposes of transmitting it to another company (to the extent these rights are provided to you under applicable law), please submit your request as directed above by contacting us here. We will process your request in accordance with applicable privacy laws. We may ask you for additional information so that we can confirm your identity or process your request and we reserve the right to charge a fee and/or refuse to act on a request where permitted by law, for example, if your request is deemed manifestly unfounded or excessive.

Direct marketing. You may always opt out of direct marketing emails. If you would like to unsubscribe from SolarWinds marketing emails or otherwise change your email preferences, go to our Email Preference https://launch.solarwinds.com/Preference-Center-unsubscribe.html Center on our Site or use the Email Preference Center link in our promotional emails to request cessation of these communications. We may continue to send you transactional or service-related communications, such as service announcements and administrative messages, from which you cannot opt out.

Complaints. If you have any concerns about our use of your Personal Data, you can make a complaint to us at privacy@SolarWinds.com. We will take steps to try to resolve any complaint you raise regarding our treatment of your Personal Data. You also have the right to raise a complaint with the privacy regulator in your jurisdiction. If you are in the EEA, you can file a complaint with our principal supervisory authority, the Irish Data Protection Commission in Ireland or with your local data protection authority where applicable.  A list of EEA data protection authorities is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. Information regarding the UK data protection authority is available at: https://ico.org.uk/. Please contact us at privacy@SolarWinds.com if you have any questions about how to raise a complaint.

Additional information for certain jurisdictions. In the section Additional Information for Certain Jurisdictions below, we provide additional information as required under California privacy laws, as well as the GDPR and UK GDPR Users in California, the EEA and the UK should review this section for more information regarding their rights under these respective laws.

Additional Information for EEA/UK Users. 

The GDPR and UK GDPR require that we inform you of the legal bases of our processing. The following table supplements the “Use of Personal Data” and “Disclosures of Personal Data” sections above by setting out the legal bases we rely upon for our processing activities and the corresponding recipients of Personal Data in more detail.

As set out in the “Use of Personal Data” section above, we process Personal Data to comply with applicable laws and regulations. In the EEA/UK, this includes:

• Civil and commercial matters: where we are in receipt of a court order to disclose information for the purposes of court proceedings, such as under Regulation (EU) No 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters or equivalent UK law.
• Criminal matters: to comply with requests and orders from EU and EU Member State or UK law enforcement to provide information in relation to a criminal investigation in compliance with applicable local laws, or to take steps to report information we believe is important to law enforcement where so required or advisable under applicable local laws.
• Consumer matters: to comply with requests from competent authorities under EU or EU Member State or UK consumer protection law, such as under Directive (EU) 2019/2161 and its implementing laws in EU Member States or equivalent UK law.
• Corporate and taxation matters: to comply with our obligations under applicable EU Member State or UK corporate and tax legislation, such as where a national tax law of an EU Member State or the UK requires collection of specific transactional Personal Data for tax purposes.
• Regulatory matters: to respond to a request or to provide information we believe is necessary or appropriate to comply with our obligations to engage with regulators, such as when relevant EU Member State or UK data protection supervisory authorities initiate investigation under the GDPR or UK GDPR. These can include authorities outside of your country or region of residence.

Additional Information for California Residents.

Additional Information for California Residents. In this section, we provide additional information to California residents about how we handle their personal information, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”). This section does not address or apply to our collection and processing of:

• Customer Data: as noted above, we are a “service provider” or “processor” for such data, which means that our processing of Customer Data on behalf of a Customer is subject to our contractual agreements with that Customer. We only process Customer Data on behalf of the relevant Customer and in compliance with our applicable agreements with the respective Customer.
• Data that Is Exempt from CCPA: including publicly available information or other personal information that is exempt under the CCPA.

While our collection, use, and disclosure of personal information varies based upon our relationship and interactions with you, in this section we describe how we have collected, used, and disclosed personal information about California (“CA”) residents in the prior 12 months (from the last updated date above).

Categories of personal information collected, “shared,” sold,” and disclosed. The table below identifies the categories of personal information (as defined by the CCPA) we collect and use, as well as which categories of personal Information we disclose to third parties for our operational business purposes, including within the prior 12 months. The chart also details the categories of personal information that we “sell” to third parties or “share” for purposes of cross-context behavioral advertising, including within the prior 12 months. For additional details about the business and commercial purposes for which we collect, use, and disclose personal information, please see the Use of Personal Data and Disclosures of Personal Data sections above.

Sales of personal information. The CCPA defines “sale” broadly to include making personal information available to a third party in exchange for receiving certain benefits or consideration from that third party. While we do not “sell” personal information to third parties in exchange for monetary compensation, we make personal information available in ways that may be considered a sale under the CCPA, such as when we make personal information available to third party ad networks through third party tags on our Sites in order to reach users with more relevant ads and content.

We do not knowingly “sell” or “share” personal information (including Sensitive Personal Information) of CA residents who are minors under 16 years of age.

Sources of personal information. As described in the “How We Collect Personal” section in the body of this Privacy Notice, above, we may collect personal information from the following sources:

• Our Customers
• Business partners and affiliates
• Directly from the individual
• Advertising networks
• Data analytics providers
• Social networks
• Resellers
• Channel partners and marketing partners
• Publicly available sources, including public databases

California residents’ rights. California residents may make the following privacy rights requests:

1. Right to Know: You may request that we disclose to you the following information:
• The categories of personal information we collected about you and the categories of sources from which we collected your personal information;
• The business or commercial purpose for collecting, “selling,” or “sharing” your personal information;
• The categories of your personal information that we “shared” or “sold” and the categories of third parties to whom we “shared” or “sold” your personal information;
• The specific pieces of your personal information; and
• The categories of your personal information that we otherwise disclosed, and the categories of third parties to whom we disclosed your personal information.

• Right to Correct: You may request that we correct inaccuracies in your personal information.
• Right to Delete: You may request that we delete your personal information.
• Right to Opt-Out of “Sale”: You may request to opt out of the “sale” of your personal information.
• Right to Opt-Out of “Sharing”: You may request to opt out of the “sharing” of your personal information for cross-context behavioral advertising.

Submitting privacy requests. California residents may submit privacy requests:

• Online at the SolarWinds data subject request form;
• By emailing privacy@solarwinds.com with the subject line “California Rights Request: California Consumer Rights”; or
• California residents may also opt out of the “sale” or “sharing” of their personal information in our Privacy Preference Center.

We also process opt-out preference signals, such as the Global Privacy Control. These signals set your opt-out preferences only for the particular browser or device you are using.  For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/. 

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. When you submit a request, we may need to verify your identity before processing your request, which may require us to request additional personal information from you, such as your name and email address or require you to log into your account, if you have one. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law.

Authorized agents may make a request on behalf of a California resident by contacting us as set forth in the Contact Information section above. We will process the agent’s request consistent with applicable law. As part of our verification process, we may request that the agent provide, as applicable, proof concerning their status as an authorized agent.  In addition, we may require that you verify your identity as described in this section or confirm that you provided the agent permission to submit the request.

You have the right not to be unlawfully discriminated against for exercising your privacy rights.

California’s “Shine the Light” law. California’s “Shine the Light” law (Civil Code Section §1798.83) provides certain rights to California residents free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing purposes; such requests may be made once per calendar year for information about any relevant third party sharing in the prior calendar year (e.g., requests submitted in 2021 would be applicable to relevant disclosures (if any) in 2020). If you are a California resident and would like to make such a request, please submit your request in writing by emailing us at privacy@SolarWinds.com using the subject line “Request for California STL Information.” In your request, please attest to the fact that you are a California resident and provide a current California address. We will reply to valid requests by sending a response to the email address from which you submitted your request. Please note that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing and the relevant details required by the Shine the Light law will be included in our response.

De-Identified Information. Where we maintain or use de-identified information of California residents, we will continue to maintain and use the de-identified information only in a de-identified manner and will not attempt to re-identify the information.

For more information about our privacy practices, you may contact us as set forth in the Contact Information section above. We also discuss SolarWinds' efforts and commitment to data protection further on the SolarWinds Trust Center.