Automattic Privacy Policy changes — 20200801_rev01

98

(5) You have given us your consent - for example before we place certain cookies on your device and access and analyze them later on, as described in our [Cookie Policy](http://www.automattic.com/cookies).

99

100

### Sharing Information

101

102

#### _How We Share Information_

103

104

We share information about you in limited circumstances, and with appropriate safeguards on your privacy. These are spelled out below, as well as in the section called [Ads and Analytics Services Provided by Others](https://automattic.wordpress.com/privacy/):

104

We share information about you in limited circumstances, and with appropriate safeguards on your privacy. These are spelled out below, as well as in the section called [Ads and Analytics Services Provided by Others](https://automattic.com/privacy/):

105

106

- **Subsidiaries and independent contractors:** We may disclose information about you to our subsidiaries and independent contractors who need the information to help us provide our Services or process the information on our behalf. We require our subsidiaries and independent contractors to follow this Privacy Policy for any personal information that we share with them.

107

- **Third-party vendors:** We may share information about you with third-party vendors who need the information in order to provide their services to us, or to provide their services to you or your site. This includes vendors that help us provide our Services to you (like Stripe, which powers WooCommerce Payments, payment providers that process your credit and debit card information, payment providers you use for your own ecommerce operations, fraud prevention services that allow us to analyze fraudulent payment transactions, cloud storage services, postal and email delivery services that help us stay in touch with you, customer chat and email support services that help us communicate with you, registrars, registries, data escrow services that allow us to provide domain registration services, and your hosting provider if your site is not hosted by Automattic); those that assist us with our marketing efforts (e.g., by providing tools for identifying a specific marketing target group or improving our marketing campaigns, and by placing ads to market our services); those that help us understand and enhance our Services (like analytics providers); those that make tools to help us run our operations (like programs that help us with task management, scheduling, word processing, email and other communications, and collaboration among our teams); other third-party tools that help us manage operations; and companies that make products available on our websites (like the extensions on WooCommerce.com), who may need information about you in order to, for example, provide technical or other support services to you. We require vendors to agree to privacy commitments in order to share information with them. Other vendors are listed in our more specific policies (e.g., our [Cookie Policy](https://automattic.com/cookies/)).

108

- **Legal and regulatory requirements:** We may disclose information about you in response to a subpoena, court order, or other governmental request. For more information on how we respond to requests for information about WordPress.com users, please see our [Legal Guidelines](https://en.support.wordpress.com/report-blogs/legal-guidelines/). Additionally, if you have a domain registered with WordPress.com, we may share your information to comply with the Internet Corporation for Assigned Names and Numbers' (ICANN) regulations, rules, or policies. For example, your information relating to your domain registration may be available in the WHOIS database, or we may be required to share your information with ICANN-approved Dispute Resolution Service Providers. Please see our [Domain Registrations and Privacy support document](https://en.support.wordpress.com/domains/domain-registrations-and-privacy/) for more details.

109

- **To protect rights, property, and others:** We may disclose information about you when we believe in good faith that disclosure is reasonably necessary to protect the property or rights of Automattic, third parties, or the public at large. For example, if we have a good faith belief that there is an imminent danger of death or serious physical injury, we [may disclose information related to the emergency without delay](https://en.support.wordpress.com/report-blogs/legal-guidelines/).

110

- **Business transfers:** In connection with any merger, sale of company assets, or acquisition of all or a portion of our business by another company, or in the unlikely event that Automattic goes out of business or enters bankruptcy, user information would likely be one of the assets that is transferred or acquired by a third party. If any of these events were to happen, this Privacy Policy would continue to apply to your information and the party receiving your information may continue to use your information, but only consistent with this Privacy Policy.

111

- **With your consent:** We may share and disclose information with your consent or at your direction. For example, we may share your information with third parties when you authorize us to do so, like when you connected your site to a social media service through our Publicize feature.

112

- **Aggregated or de-identified information:** We may share information that has been aggregated or de-identified, so that it can no longer reasonably be used to identify you. For instance, we may publish aggregate statistics about the use of our Services, or share a hashed version of your email address to facilitate customized ad campaigns on other platforms.

113

- **Site owners:** If you have a WordPress.com account and interact with another site using our Services, your information may be shared with the administrators of the site. For example, if you leave a comment on a site created on WordPress.com or running Jetpack, your IP address and the email address associated with your WordPress.com account may be shared with the administrator(s) of the site where you left the comment. Or if you make a payment (like via [Recurring Payments](https://en.support.wordpress.com/recurring-payments/)) to a site, your public display name, user name, and email address may be shared with the administrator(s) of the site.

113

- **Site owners:** If you have a WordPress.com account and interact with another site using our Services, your information may be shared with the administrators of the site. For example, if you leave a comment on a site created on WordPress.com or running Jetpack, your IP address and the email address associated with your WordPress.com account may be shared with the administrator(s) of the site where you left the comment. Or if you make a payment (like via the [Payments feature](https://en.support.wordpress.com/recurring-payments/)) to a site, your public display name, user name, and email address may be shared with the administrator(s) of the site.

114

- **Published support requests:** If you send us a request for assistance (for example, via a support email or one of our other feedback mechanisms), we reserve the right to publish that request in order to clarify or respond to your request, or to help us support other users.

115

116

We have a long-standing policy that we do not sell our users' data. We aren't a data broker, we don't sell your personal information to data brokers, and we don't sell your information to other companies that want to spam you with marketing emails.

117

118

We show ads on some of our users' sites as well as some of our own, and the revenue they generate lets us offer free access to some of our Services so that money doesn't become an obstacle to having a voice.

119

13	13	Howdy! We are the folks behind a variety of products and services designed to allow anyone - from bloggers, to photographers, small business owners, and enterprises - to take full advantage of the power and promise of the open web. Our mission is to democratize publishing and commerce so that anyone with a story can tell it, and anyone can turn their great idea into a livelihood. We believe in powering the open internet with code that is open source and are proud to say that the vast majority of our work is available under the General Public License ("GPL"). Unlike most other services, because our GPL code is public, you can actually download and take a look at that code to see how it works.
14	14
15	15	This Privacy Policy applies to information that we collect about you when you use:
16	16
17	17	- Our websites (including automattic.com, wordpress.com, vip.wordpress.com, jetpack.com, woocommerce.com, crowdsignal.com, gravatar.com, intensedebate.com, vaultpress.com, akismet.com, simplenote.com, simperium.com, leandomainsearch.com, cloudup.com, longreads.com, atavist.com, and happy.tools);
18	18	- Our mobile applications (including the WordPress mobile app for Android and iOS);
19		- Our other Automattic products, services, and features that are available on or through our websites (for example, WordPress.com plans, Recurring Payments, Simple Payments, WordPress.com VIP, Jetpack, the WooCommerce Services Extension, Gravatar, the IntenseDebate comment management system, Akismet plans, Simplenote, Simperium, Cloudup, Longreads, and Happy Tools); and
	19	- Our other Automattic products, services, and features that are available on or through our websites (for example, WordPress.com plans, the Payments feature, the Pay with PayPal block, WordPress.com VIP, Jetpack, the WooCommerce Services Extension, Gravatar, the IntenseDebate comment management system, Akismet plans, Simplenote, Simperium, Cloudup, Longreads, and Happy Tools); and
20	20	- Other users' websites that use our Services, while you are logged in to your account with us.
21	21
22	22	This Privacy Policy also applies to information we collect when you apply for a job at Automattic.
23	23
24		Throughout this Privacy Policy we'll refer to our websites, mobile applications, and other products and services collectively as "Services." And if you'd like to learn more about which Automattic company is the controller of information about you, take a look at the section below on [Controllers and Responsible Companies](https://automattic.wordpress.com/privacy/).
	24	Throughout this Privacy Policy we'll refer to our websites, mobile applications, and other products and services collectively as "Services." And if you'd like to learn more about which Automattic company is the controller of information about you, take a look at the section below on [Controllers and Responsible Companies](https://automattic.com/privacy/).
25	25
26	26	Please note that this Privacy Policy does not apply to any of our products or services, like Tumblr, that have a separate privacy policy.
27	27
28	28	Below we explain how we collect, use, and share information about you, along with the choices that you have with respect to that information.
29	29
30	30	### Creative Commons Sharealike License
40	40	#### _Information You Provide to Us_
41	41
42	42	It's probably no surprise that we collect information that you provide to us directly. Here are some examples:
43	43
44	44	- Basic account information: We ask for basic information from you in order to set up your account. For example, we require individuals who sign up for a WordPress.com account to provide an email address and password, along with a username or name - and that's it. You may provide us with more information - like your address and other information you want to share - but we don't require that information to create a WordPress.com account.
45	45	- Public profile information: If you have an account with us, we collect the information that you provide for your public profile. For example, if you have a WordPress.com account, your username is part of that public profile, along with any other information you put into your public profile, like a photo or an "About Me" description. Your public profile information is just that - public - so please keep that in mind when deciding what information you would like to include.
46		- Payment and contact information: If you buy something from us or earn revenue through your site, we'll collect information to process those payments and contact you. If you buy something from us - a subscription to a WordPress.com plan, a premium theme, a [custom domain](https://en.support.wordpress.com/domains/domain-registrations-and-privacy/), some Longreads swag - or if you pay fees to a person or business through their WordPress.com site (for example via Recurring Payments or Simple Payments), you'll provide additional personal and payment information like your name, credit card information, and contact information. We also keep a record of the purchases you've made. If you use our Ecommerce Services (including [Store on WordPress.com,](https://en.support.wordpress.com/store/) the [WooCommerce Services extension](https://docs.woocommerce.com/document/woocommerce-services/), and WooCommerce Payments), you'll have to create a WordPress.com account or connect an existing account and, for some Services, provide your site URL. You may also provide us with financial details to set up a payments integration, like the email address for your Stripe or PayPal account or your bank account information. If you participate in a revenue sharing opportunity for your site, like [WordAds](https://wordads.co/), you'll provide some additional information - for example, a tax ID or other identifier so we can process payments to you.
	46	- Payment and contact information: If you buy something from us or earn revenue through your site, we'll collect information to process those payments and contact you. If you buy something from us - a subscription to a WordPress.com plan, a premium theme, a [custom domain](https://en.support.wordpress.com/domains/domain-registrations-and-privacy/), some Longreads swag - or if you pay fees to a person or business through their WordPress.com site (for example via the Payments feature or the Pay with PayPal block), you'll provide additional personal and payment information like your name, credit card information, and contact information. We also keep a record of the purchases you've made. If you use our Ecommerce Services (including [Store on WordPress.com,](https://en.support.wordpress.com/store/) the [WooCommerce Services extension](https://docs.woocommerce.com/document/woocommerce-services/), and WooCommerce Payments), you'll have to create a WordPress.com account or connect an existing account and, for some Services, provide your site URL. You may also provide us with financial details to set up a payments integration, like the email address for your Stripe or PayPal account or your bank account information. If you participate in a revenue sharing opportunity for your site, like [WordAds](https://wordads.co/), you'll provide some additional information - for example, a tax ID or other identifier so we can process payments to you.
47	47	- Happy Tools information: If you are a Happy Tools user, you will provide us with information to set up your Happy Tools account and make use of the Service's features. For example, you might enter timezone and location information, company and team information, and contact information.
48	48	- Content information: You might provide us with information about you in draft and published content (a blog post or comment that includes biographic information about you, or any media or files you upload).
49	49	- Credentials: Depending on the Services you use, you may provide us with credentials for your self-hosted website (like SSH, FTP, and SFTP username and password). Jetpack and VaultPress users may provide us with these credentials in order to use our one-click restore feature if there is a problem with their site, or to allow us to troubleshoot problems more quickly.
50	50	- Communications with us (hi there!): You may also provide us with information when you respond to surveys, communicate with our Happiness Engineers about a support question, post a question in our public forums, or sign up for a newsletter like the one we send through Longreads. When you communicate with us via form, email, phone, WordPress.com comment, or otherwise, we store a copy of our communications (including any call recordings as permitted by applicable law).
51	51	- Job applicant information: If you apply for a job with us - awesome! You may provide us with information like your name, contact information, resume or CV, and work authorization verification as part of the application process.
52	52
98	98	(5) You have given us your consent - for example before we place certain cookies on your device and access and analyze them later on, as described in our [Cookie Policy](http://www.automattic.com/cookies).
99	99
100	100	### Sharing Information
101	101
102	102	#### _How We Share Information_
103	103
104		We share information about you in limited circumstances, and with appropriate safeguards on your privacy. These are spelled out below, as well as in the section called [Ads and Analytics Services Provided by Others](https://automattic.wordpress.com/privacy/):
	104	We share information about you in limited circumstances, and with appropriate safeguards on your privacy. These are spelled out below, as well as in the section called [Ads and Analytics Services Provided by Others](https://automattic.com/privacy/):
105	105
106	106	- Subsidiaries and independent contractors: We may disclose information about you to our subsidiaries and independent contractors who need the information to help us provide our Services or process the information on our behalf. We require our subsidiaries and independent contractors to follow this Privacy Policy for any personal information that we share with them.
107	107	- Third-party vendors: We may share information about you with third-party vendors who need the information in order to provide their services to us, or to provide their services to you or your site. This includes vendors that help us provide our Services to you (like Stripe, which powers WooCommerce Payments, payment providers that process your credit and debit card information, payment providers you use for your own ecommerce operations, fraud prevention services that allow us to analyze fraudulent payment transactions, cloud storage services, postal and email delivery services that help us stay in touch with you, customer chat and email support services that help us communicate with you, registrars, registries, data escrow services that allow us to provide domain registration services, and your hosting provider if your site is not hosted by Automattic); those that assist us with our marketing efforts (e.g., by providing tools for identifying a specific marketing target group or improving our marketing campaigns, and by placing ads to market our services); those that help us understand and enhance our Services (like analytics providers); those that make tools to help us run our operations (like programs that help us with task management, scheduling, word processing, email and other communications, and collaboration among our teams); other third-party tools that help us manage operations; and companies that make products available on our websites (like the extensions on WooCommerce.com), who may need information about you in order to, for example, provide technical or other support services to you. We require vendors to agree to privacy commitments in order to share information with them. Other vendors are listed in our more specific policies (e.g., our [Cookie Policy](https://automattic.com/cookies/)).
108	108	- Legal and regulatory requirements: We may disclose information about you in response to a subpoena, court order, or other governmental request. For more information on how we respond to requests for information about WordPress.com users, please see our [Legal Guidelines](https://en.support.wordpress.com/report-blogs/legal-guidelines/). Additionally, if you have a domain registered with WordPress.com, we may share your information to comply with the Internet Corporation for Assigned Names and Numbers' (ICANN) regulations, rules, or policies. For example, your information relating to your domain registration may be available in the WHOIS database, or we may be required to share your information with ICANN-approved Dispute Resolution Service Providers. Please see our [Domain Registrations and Privacy support document](https://en.support.wordpress.com/domains/domain-registrations-and-privacy/) for more details.
109	109	- To protect rights, property, and others: We may disclose information about you when we believe in good faith that disclosure is reasonably necessary to protect the property or rights of Automattic, third parties, or the public at large. For example, if we have a good faith belief that there is an imminent danger of death or serious physical injury, we [may disclose information related to the emergency without delay](https://en.support.wordpress.com/report-blogs/legal-guidelines/).
110	110	- Business transfers: In connection with any merger, sale of company assets, or acquisition of all or a portion of our business by another company, or in the unlikely event that Automattic goes out of business or enters bankruptcy, user information would likely be one of the assets that is transferred or acquired by a third party. If any of these events were to happen, this Privacy Policy would continue to apply to your information and the party receiving your information may continue to use your information, but only consistent with this Privacy Policy.
111	111	- With your consent: We may share and disclose information with your consent or at your direction. For example, we may share your information with third parties when you authorize us to do so, like when you connected your site to a social media service through our Publicize feature.
112	112	- Aggregated or de-identified information: We may share information that has been aggregated or de-identified, so that it can no longer reasonably be used to identify you. For instance, we may publish aggregate statistics about the use of our Services, or share a hashed version of your email address to facilitate customized ad campaigns on other platforms.
113		- Site owners: If you have a WordPress.com account and interact with another site using our Services, your information may be shared with the administrators of the site. For example, if you leave a comment on a site created on WordPress.com or running Jetpack, your IP address and the email address associated with your WordPress.com account may be shared with the administrator(s) of the site where you left the comment. Or if you make a payment (like via [Recurring Payments](https://en.support.wordpress.com/recurring-payments/)) to a site, your public display name, user name, and email address may be shared with the administrator(s) of the site.
	113	- Site owners: If you have a WordPress.com account and interact with another site using our Services, your information may be shared with the administrators of the site. For example, if you leave a comment on a site created on WordPress.com or running Jetpack, your IP address and the email address associated with your WordPress.com account may be shared with the administrator(s) of the site where you left the comment. Or if you make a payment (like via the [Payments feature](https://en.support.wordpress.com/recurring-payments/)) to a site, your public display name, user name, and email address may be shared with the administrator(s) of the site.
114	114	- Published support requests: If you send us a request for assistance (for example, via a support email or one of our other feedback mechanisms), we reserve the right to publish that request in order to clarify or respond to your request, or to help us support other users.
115	115
116	116	We have a long-standing policy that we do not sell our users' data. We aren't a data broker, we don't sell your personal information to data brokers, and we don't sell your information to other companies that want to spam you with marketing emails.
117	117
118	118	We show ads on some of our users' sites as well as some of our own, and the revenue they generate lets us offer free access to some of our Services so that money doesn't become an obstacle to having a voice.
119	119
203	203	### Controllers and Responsible Companies
204	204
205	205	Automattic's Services are worldwide. Different Automattic companies are the controller (or co-controller) of personal information, which means that they are the company responsible for processing that information, based on the particular service and the location of the individual using our Services.
206	206
207	207	Depending on the Services you use, more than one company may be the controller of your personal data. Generally, the "controller" is the Automattic company that entered into the contract with you under the Terms of Service for the product or service you use. In addition, Automattic Inc., our US-based company, is the controller for some of the processing activities across all of our Services worldwide.
208	208
209		The chart below explains the controllers for processing your personal information. We use the term "Designated Countries" to refer to Australia, Canada, Japan, Mexico, New Zealand, and all countries located in the European continent.
	209	The chart below explains the current controllers for processing your personal information. We use the term "Designated Countries" to refer to Australia, Canada, Japan, Mexico, New Zealand, Russia, and all countries located in the European continent.
210	210
211		<table><tbody><tr><td>If you reside outside of the Designated Countries (for services other than those offered at WooCommerce.com):</td><td><strong>Automattic Inc.</strong><br>60 29th Street #343<br>San Francisco, CA 94110</td></tr><tr><td>If you reside in the Designated Countries (for services other than those offered at WooCommerce.com):</td><td><strong>Aut O'Mattic A8C Ireland Ltd.</strong><br>Business Centre, No.1 Lower Mayor Street<br>International Financial Services Centre<br>Dublin 1, Ireland<strong>Automattic Inc.</strong> is also the controller for some of the processing activities related to Services provided by Aut O'Mattic A8C Ireland Ltd.</td></tr><tr><td>If you are using our Services offered at WooCommerce.com:</td><td><strong>Bubblestorm Management (Pty) Ltd (WooCommerce.com)</strong><br>Unit A206, The Old Biscuit Mill (TOBM)<br>373 - 375 Albert Road, Woodstock<br>Cape Town, South Africa<br><strong>Automattic Inc.</strong> is also the controller for some of the processing activities related to Services provided by Bubblestorm Management (Pty) Ltd (WooCommerce.com).</td></tr></tbody></table>
	211	<table><tbody><tr><td>If you reside outside of the Designated Countries:</td><td><strong>Automattic Inc.</strong><br>60 29th Street #343<br>San Francisco, CA 94110</td></tr><tr><td>If you reside in the Designated Countries:</td><td><strong>Aut O'Mattic A8C Ireland Ltd.</strong><br>Business Centre, No.1 Lower Mayor Street<br>International Financial Services Centre<br>Dublin 1, Ireland<p><strong>Automattic Inc.</strong> is also the controller for some of the processing activities related to Services provided by Aut O'Mattic A8C Ireland Ltd.</p></td></tr></tbody></table>
212	212
213	213	### How to Reach Us
214	214
215		If you have a question about this Privacy Policy, or you would like to contact us about any of the rights mentioned in the [Your Rights section](https://automattic.wordpress.com/privacy/) above, please contact us through our [web form](https://wordpress.com/help/contact) or via [email](mailto:privacypolicyupdates@automattic.com). These are the fastest ways to get a response to your inquiry, but you can also contact us by telephone at 1-877-273-3049.
	215	If you have a question about this Privacy Policy, or you would like to contact us about any of the rights mentioned in the [Your Rights section](https://automattic.com/privacy/) above, please contact us through our [web form](https://wordpress.com/help/contact) or via [email](mailto:privacypolicyupdates@automattic.com). These are the fastest ways to get a response to your inquiry, but you can also contact us by telephone at 1-877-273-3049.
216	216
217	217	### Other Things You Should Know (Keep Reading!)
218	218
219	219	#### _Transferring Information_
220	220
221		Because Automattic's Services are offered worldwide, the information about you that we process when you use the Services in the EU may be used, stored, and/or accessed by individuals operating outside the European Economic Area (EEA) who work for us, other members of our group of companies, or third-party data processors. This is required for the purposes listed in the [How and Why We Use Information section](https://automattic.wordpress.com/privacy/) above. When providing information about you to entities outside the EEA, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy as required by applicable law. These measures include:
	221	Because Automattic's Services are offered worldwide, the information about you that we process when you use the Services in the EU may be used, stored, and/or accessed by individuals operating outside the European Economic Area (EEA) who work for us, other members of our group of companies, or third-party data processors. This is required for the purposes listed in the [How and Why We Use Information section](https://automattic.com/privacy/) above. When providing information about you to entities outside the EEA, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy as required by applicable law. These measures include:
222	222
223	223	- In the case of US based entities, entering into European Commission approved standard contractual arrangements with them, or ensuring they have signed up to the [EU-US Privacy Shield](https://www.privacyshield.gov/welcome); or
224	224	- In the case of entities based in other countries outside the EEA, entering into European Commission approved standard contractual arrangements with them.
225	225
226	226	You can ask us for more information about the steps we take to protect your personal information when transferring it from the EU.
227	227
260	260	In the event of a conflict between a translated version of our Privacy Policy and the English version, the English version will control.
261	261
262	262	That's it! Thanks for reading.
263	263
264	264	### Change log
265	265
	266	- August 1, 2020: Renamed some Payments features and updated the "Controllers and Responsible Companies" section to reflect changes affecting WooCommerce users.
266	267	- February 21, 2020: Updated for WooCommerce Payments and added a new section: "Other Information and Resources."
267	268	- _December 31, 2019_: Updated for California Consumer Privacy Act and miscellaneous clarification throughout.
268	269	- _October 2, 2019:_ A few miscellaneous changes, such as new sections about translations of this Privacy Policy and how to opt out of our internal analytics program.
269	270	- _May 31, 2019:_ Included information for the Recurring Payments feature.
270	271	- _April 1, 2019:_ Included information for Happy Tools.
271	272	- _March 13, 2019:_ Added clarifications and additional details to existing sections, for example about ICANN policies and what we may store when you communicate with us.

Privacy Policy

Full text changes — 20200701_rev01 to 20200801_rev01