Privacy Policy

How We Collect

CoreView collects your Personal Data through a variety of means. We may collect your Personal Data over the phone, via email, through our website, and in person at meetings and tradeshows. If you speak to us over the phone, we may record or monitor sales, support, or service-related calls for purposes such as quality assurance, training, security, and service improvement. Where required by applicable law, you will be notified prior to recording, and by continuing the call you acknowledge that the communication may be recorded.

Call recordings may include voice recordings, caller identification information, and information voluntarily provided during the call. Recordings may be processed by us or our authorized service providers and stored in jurisdictions where we or our providers operate, subject to appropriate safeguards. Where required by applicable law, including the GDPR and similar privacy frameworks, recordings are processed based on legitimate business interests, contractual necessity, or legal obligations.

Data We Collect and Process

CoreView’s Services, including Corey AI, are designed for businesses and are not intended for personal or household use.  Accordingly, we treat all Personal Data covered by this Privacy Policy, including information about any visitors to our Sites, as individuals representing and acting on behalf of their employer.  If you do not wish to provide us with your Personal Data, or to have it processed by us or by any of our subprocessors, please do not provide such data, avoid any interaction with us and do not leave any information on our website, and refrain from using our Services. 

We process Personal Data that you may provide voluntarily or that we collect in performing the Services for your organization that we acquire from your organization or from third parties.We process Personal Data that you may provide voluntarily or that we collect in performing the Services for your organization that we acquire from your organization or from third parties.

The Personal Data that we process and have processed for one of the purposes described below in the last 12 months includes:

• Identifier, such as your first and last name and email address.  Your email address is usually, but not always, your employee email address.
• Internet and network activity, such as metadata regarding your usage of your organization’s Microsoft 365 software such as information on the actions you perform on Microsoft 365 software and the time and frequency of such actions as well as data regarding your use of our Sites and Services (“Usage Data”), including IP address, geographical location, browser type, operating system, referral source, length of visit, page views, and navigation paths.
• Personal Data we collect from other sources such as public databases, social media platforms, third-party data providers. We take steps to ensure that such third parties are legally or contractually permitted to disclose such information to us.
• Information required to send you communications you have consented to receive (“Correspondence Data”), and information that you provide for subscribing to our email notifications and/or newsletters (“Notification Data”).
• Commercial information, including information that you provide for us to communicate with you regarding transactions between you and us (“Transaction Data”).
• Information that you post for publication on the Site or through our Services (“Publication Data”).
• Information contained in any inquiry you submit to us regarding the Services, e.g. a help desk request ("Inquiry Data”).
• Information that you provide to communicate with Corey, our AI agent (“Corey Data”).

We do not collect, access, or scan any ofyour organization’s content, including e-mail messages, calendar entries, contactlists, address books, or SharePoint documents or content.

We do not intentionally process any sensitive personal information or specially-protected categories of Personal Data as defined by the California Consumer Privacy Act/California Consumer Privacy Act(CCPA/CPRA) and the European Union’s General Data Protection Regulation (GDPR), such as data relating to racial or ethnic origin, political, religious, or philosophical beliefs, trade union membership, sexual orientation, biometric or genetic data, health, and medical treatment, etc.

Data we collect (Configuration Manager):

1. Sync Operations (e.g. Export, Preview, Deploy)
2. Status of sync operation (success/failure)
3. Number of licenses in tenant Azure DevOps/GitHub organization name
4. Name of sync operation

Optional Data collection (Configuration Manager) 

- Failed sync details including error message

Data Not Collected (Configuration Manager)

- Customer environment details including, but not limited to, Microsoft tenant ID, users/groups, permissions, & system configurations

Data protection laws such as the European Union’s General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR) and the California Consumer Protection Act (CCPA), define two separate roles for parties processing Personal Data.  A “data controller” (or “business” under the CCPA) determines the scope, purposes, and means for processing your Personal Data.  Your employer typically will be a data controller.  A “data processor” (or“service provider” under the CCPA) processes your Personal Data on behalf of the data controller (or business).  CoreView is usually the data processor (or service provider) with respect to your Personal Data that falls under the definition of “Client Data” or “User Data” as defined at the beginning of this Policy.  On the other hand, CoreView is a data controller of Personal Data falling within the definition of “Prospect Data” as defined above.  Generally, if your employer allows CoreView to access your Personal Data, this will qualify as either Client Data or User Data.  If you provide CoreView your Personal Data directly, e.g. on CoreView’s website or as part of a request for contact with a CoreView representative, your Personal Data will qualify as Prospect Data.

When acting as a data processor, CoreView processes Personal Data strictly in accordance with reasonable instructions from its customers as stipulated in our Data Protection and Information Security Addendum and our legal agreements with the customer. CoreView’s customers are directly responsible for handling data subject right requests under applicable law.

Release of Non-Personally Identifiable Information.

We may disclose or share Non-Personally Identifiable Information with Third Party Providers and the public. For example, we may share aggregated demographic information (which does not include any Personally Identifiable Information) or use Third Party Providers to track and analyze Non-Personally Identifiable statistical information on usage and volume from our users to administer the Service. We may also publish this aggregated information for promotional purposes.  Such data is collected on our behalf and is owned and used by us.

Legal Basis For Processing

We rely on several legal bases in accordance with applicable data protection laws. These legal bases are:

• Contractual Necessity: We may process Personal Data to conclude and perform a contract with you, such as when Personal Data is required to provide and support Services.
• Legal Obligation: We may process Personal Data to comply with law or fulfil certain legal obligations.
• Consent: In some instances, we may ask for your consent before we collect, use, or disclose your Personal Data.
• Legitimate Interests: We may process your Personal Data where processing is necessary for our legitimate interests or the legitimate interests of a third party, subject to appropriate privacy protections as required by law.

We do not sell or share personal data with third parties in exchange for payment.

Additional Data-Processing Purposes

If we need to use your Personal Data for reasons other than those above, we will notify you prior to processing whether the provision of Personal Information we are collecting is compulsory or if it may be provided on a voluntary basis and the consequences, if any, of not providing the information.

Where Your Personal Data is Stored

CoreView uses Microsoft Azure data centers to store your organization’s data, including Personal Data. When your organization initially sets up its account with CoreView, it has a choice of five (5) data center locations. Two are located in the United States, one in Canada, one in Australia, and one in Europe (Dublin, Ireland).  Data from European Clients is stored in the Dublin, Ireland data center.

Recipients of Your Personal Data

Your Personal Data may be processed by a third party on our behalf, in a predominantly automated and computerized manner, to guarantee security and confidentiality and to prevent unauthorized access to the data themselves. CoreView does not perform any automated decision-making, including profiling.

We may need to communicate your Personal Data to third parties belonging to the following categories:

• People involved in technical and organizational activity on our behalf (including payroll activity).
• Subsidiaries, parent companies and affiliates of CoreView USA, Inc., CoreView S.r.l., or Simeon Cloud, LLC.
• Business/marketing partners.
• Authorities and in general, subjects, public or private, with functions of public importance.
• External companies and / or professionals that assist us.
• Successor(s) of our business, relating to all or part of the business, to evaluate a proposed transaction or sale, reorganization, merger, acquisition, or other change of control.
• Third-party companies for processing related to promotional initiatives, but only if you have consented to such processing.
• To a government authority or law enforcement agency when required to do so by law, such as in response to a validly-issued subpoena or court order. Such disclosures will be made only to the extent necessary to comply with applicable legal obligations.
• Any other sharing or disclosure with your consent.

We will not sell, distribute, disclose, or lease your Personal Information to third parties unless we have your permission or are required by law to do so. CoreView may disclose Personal Data.

CoreView will evaluate the legitimacy of such requests and, where permitted, notify affected individuals before providing any data. Additionally, we will take reasonable steps to ensure that any disclosure is consistent with applicable data protection laws and respects the privacy rights of our users. Your Personal Data will not be disseminated for any other reasons outside of those detailed in this policy.

International Data Transfers

CoreView’s subprocessors may be in countries other than where the Personal Data is stored. Also, CoreView USA,Inc. is based in the United States and CoreView, S.r.l. is based in Milan, Italy. As a result, Personal Data may be accessed by CoreView personnel or subprocessors that are located outside of the country where the Personal Data is stored. Such access to Personal Data is a “transfer”, so this access is governed by contractual or legal mechanisms designed to ensure that your rights(see “Your Rights” below) are preserved. For example, if your Personal Data is protected by the European Union’s General Data Protection Regulation (GDPR),then access by CoreView and its subprocessors to your Personal Data across international borders is governed by mechanisms such as Standard Contractual Clauses with subprocessors.

For data transfers from the European Union, Switzerland, or the UK to countries which are not deemed to offer an adequate level of data protection, CoreView and its data importers and exporters have entered into Standard Contractual Clauses as approved by the European Commission, Swiss Federal Data Protection and Information Commissioner (FDPIC), and the UK Information Commissioner’s Office(UK ICO). You can obtain a copy of these clauses by contacting us directly at privacy@coreview.com.  

Data Retention

Your Personal Data will be stored for a time not exceeding that necessary to achieve the purposes for which it was collected (e.g. so that CoreView can provide its Services to your organization), to defend our legal rights, or as long as we are required to retain it due to legal requirements.  Unless our contractual obligations with our Client require otherwise, we will permanently delete Personal Data associated with the Service no later than ninety (90) days after your organization’s account is terminated or expires.

Furthermore, even if your organization’s account remains active, but we have no ongoing legitimate need to process your Personal Data, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion or anonymization is possible.

Our Security

We take appropriate and reasonable technical and organizational measures to protect your Personal Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction, considering the risks involved in the processing and the nature of the Personal Data. More details on CoreView’s security program may be found on our Security Page.

Disclaimer

Our Services are intended for use by our Clients. As a result, for much of the Personal Information we collect and process about Users through the Services, we act as a processor on behalf of our Clients. We are not responsible for the privacy or security practices of our Clients, which may differ from those set forth in this privacy policy.

What We Do With Personal Data We Gather

We may use your Personal Data for a variety of purposes including:

• To provide, maintain, and perform our Services, including to train Corey AI and its underlying models.
• Compliance with legal obligations, including carrying out our obligations and enforcing our rights arising from any contracts entered into with our Client; as necessary or appropriate to protect the rights, property or safety of us or others; to comply with applicable laws, regulations, and programmatic recordkeeping requirements; and to respond to law enforcement requests or as otherwise required by applicable law, court order, or government regulation.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer or some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data is among the assets transferred.
• To analyze your use of and interaction with our Services in order to operate, maintain, and improve the same, personalize your experience, provide recommendations, inform you of our Services, and those of our affiliates and partners that may be of interest to you, and otherwise to better understand your needs and to track trends and usage of our Services.
• To improve our Services (e.g. detection of the degree of customer satisfaction on the quality of services rendered, the preparation of studies and market research).
• To provide Client with the information or Services it requests.    
• To contact you, respond to your requests, and otherwise to communicate with you, including informing you via marketing communications about our products and / or services that we think you may be interested in through letters, telephone, advertising material, automated communication systems and in particular, newsletters (subject to your specific, express consent).
• CoreView may use marketing techniques to deliver relevant content and promotions based on user preferences and interactions. This may involve grouping users into segments based on non-personally identifiable information, such as usage patterns and general demographics. We do not share Personal Data with third parties for their own marketing purposes without your explicit consent. Users can opt out of marketing communications at any time by unsubscribing or by contacting us.
• As otherwise described to you when collecting your Personal Data, for any other purpose for which you provide consent, or as otherwise required or permitted by law.

Your Rights

Depending on the applicable laws of the jurisdiction in which you reside, you may have the following rights regarding your Personal Data that we process:

• To be informed of and request access to the Personal Data that we process (right of access).
• To request that we amend or update your Personal Data if it is inaccurate or incomplete (right of rectification).
• To request that we delete your Personal Data (right to erasure).
• To request that we temporarily or permanently stop processing all or some of your Personal Data (right to restrict processing).
• To request a copy of your Personal Data in electronic format and the right to transmit that Personal Data for use in another party’s service (right to data portability).
• To object to us processing your Personal Data on grounds relating to your particular situation at any time (right to object).
• Right to opt out of the sale or sharing of your Personal Data for “targeted advertising” as defined by applicable privacy laws.
• If you live in a jurisdiction subject to the GDPR, you also have the right to file a complaint with the relevant supervisory authority in the EU or the UK, as applicable.  You may also designate an authorized agent, via a power of attorney, who may exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by forwarding the power of attorney to privacy@coreview.com.  

When exercising your rights under this policy or applicable law, we may require you to provide us with certain credentials containing your personal information to ensure that you are who you claim to be to avoid disclosure of your Personal Data to unauthorized persons or Personal Data related to others.  We may also request further information from you to clarify the nature and scope of data that you are requesting.  If such request relates to Personal Data that CoreView processes on behalf of one of its customers, as a “data processor” (as explained more fully below), then such customer exclusively determines how your Personal Data is processed, as well as how to handle your request, so you are encouraged to contact the customer directly regarding your request.  CoreView cannot fulfill your request unless you have provided sufficient information enabling it to reasonably verify whether CoreView or its customer initially collected your Personal Data.  Coreview may also retain this information and certain Personal Data for legal purposes, e.g., to document our compliance with your request, and as proof that our disclosure was to the correct individual.

In fulfilling all requests for disclosure of Personal Data, we may redact any Personal Data belonging to others, as well as any information that CoreView or a third party (e.g., CoreView’s customer) considers confidential. Individuals residing in the EEA, UK or Switzerland with inquiries or complaints regarding CoreView’s Privacy compliance should submit inquiries to privacy@coreview.com.  If you do not receive timely acknowledgement and action of your request or complaint regarding our processing of your Personal Data under the Data Privacy Framework, or if we have not addressed such request or complaint to your satisfaction, CoreView shall cooperate with the European Union Data Protection Authorities, the UK Information Commissioner’s Office (UK ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) to independently address complaints that we have been unable to resolve.  CoreView is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

Privacy Notice for California Residents

The California Consumer Privacy Act (CCPA) as amended, gives California residents certain rights regarding their data. Many of these rights address the sale of Personal Data, which CoreView does not do. If you have specific questions regarding your rights under the CCPA, please contact us at privacy@coreview.com.

Additional terms that apply to some residents of the European Economic Area (EEA)

In addition to the rights already recorded above, if you are based in the EEA, you may have the following additional rights in relation to the personal information we hold about you, in accordance with The General Data Protection Regulation 2016/67 (GDPR). More information regarding your rights, and CoreView’s compliance with GDPR can be found in CoreView’s Data Processing Addendum.

Cookies Policy

How To Manage Cookies

You can choose to accept or decline cookies.

Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer.

You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed. Please check your browser’s instructions on how to do so.

In the case of cookies provided by third parties, you can opt out via (i) your browser settings (ii) an opt out link (if provided), or (iii) by contacting the third party directly or by following opt-out instructions on such third party’s privacy policy.

Blocking cookies may prevent you from taking full advantage of functionality available on our website.

Links To Other Websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

‍Questions, concerns or complaints: If you have any comments or questions regarding our privacy policy or practices, or if you have any concerns regarding your Personal Data held with us, or if you wish to make a complaint about how your Personal Data is being processed by CoreView, please contact us at privacy@coreview.com.