1. Who Are We
Harness Inc. (“Harness,” “we,” “us,” “our”) is the controller of the personal data described in this Privacy Statement. This statement explains how we collect, use, share, and protect personal data when you:
- visit harness.io or other websites we own and control;
- register for or attend a Harness event;
- subscribe to our newsletters or marketing communications; or
- deal with us as a customer, prospect, partner, or other business contact.
This Privacy Statement does not cover:
|
Role
|
Details
|
|
Data Controller
|
Harness Inc., 55 Stockton St, 8th Floor, San Francisco, CA 94108, USA.
privacy@harness.io
|
|
EU Representative
|
Harness France SAS, 92 Av. des Champs-Élysées, 75008 Paris, France.
privacy@harness.io
|
2. What We Collect, Why, and Our Legal Basis
Depending on your interaction with Harness, different parts of this Privacy Statement may be relevant to you. Reference the applicable chart below that matches your activity to understand how we handle your personal data when:
2.1 Website Visitors
|
Data
|
Purpose
|
Legal basis
|
|
Contact information (e.g., Name, email, phone, job title, company)
|
Respond to your request
|
Legitimate interests (Art. 6(1)(f))
Pre-contractual steps (Art. 6(1)(b))
|
|
Website browsing data (e.g., IP address, cookie IDs, browser type, pages visited, etc.)
|
Operate and secure the website
Analytics, personalized content, targeted advertising
|
See Cookies Notice
|
|
Company and contact details matched to website visits
|
Identify businesses that visit our website for sales follow-up
|
See Cookies Notice
|
2.2 Event Participants and Speakers
|
Data
|
Purpose
|
Legal basis
|
|
Contact information (e.g. Name, email, phone, job title, company, industry, country)
|
Register you, run the event, send post-event resources
|
Contract performance (Art. 6(1)(b))
|
|
Event data (e.g., Attendance status, badge scans, etc.)
|
Event administration and follow-up
|
Contract performance (Art. 6(1)(b))
|
|
Event data (e.g., Photos and video of sessions and attendees)
|
Promote Harness and our events
|
Legitimate interests (Art. 6(1)(f))
|
|
Event data (e.g., Registration data shared with sponsors or partners)
|
Sponsor and partner follow-up
|
Consent (Art. 6(1)(a))
|
|
Speaker data (e.g., session recordings, speaker release, banking details (IBAN for paid speakers), travel and accommodation)
|
Speaker logistics, payment, publication of sessions
|
Contract performance (Art. 6(1)(b))
Legal obligation (Art. 6(1)(c)) for tax and accounting records
|
2.3 Newsletter Subscription & Website Forms
|
Data
|
Purpose
|
Legal basis
|
|
Contact information (e.g. Name, email, etc.)
|
Send newsletters and marketing emails
|
Consent (Art. 6(1)(a))
Legitimate interests (Art. 6(1)(f)) (existing customers)
|
|
Preference data (e.g., Subscription selections, opt-in and opt-out status, topic interests)
|
Respect your preferences
|
Consent (Art. 6(1)(a))
|
2.4 Other Business Contacts (Customers, Prospects & Partners)
|
Data
|
Purpose
|
Legal basis
|
|
Contact information (e.g. Name, email, phone, job title, company, industry, country)
|
Respond to enquiries; manage our relationship
|
Legitimate interests (Art. 6(1)(f))
Pre-contractual steps (Art. 6(1)(b))
|
|
CRM and sales data (e.g., Lead source, qualification, funnel stage, intent signals, lead scores, purchase history, account status, call and meeting notes, direct mail records)
|
Sales outreach, lead scoring, CRM management, analytics, reporting
|
Legitimate interests (Art. 6(1)(f))
|
|
Prospecting enrichment data (e.g., Supplemental job title, phone, company details, email deliverability, buying intent)
|
Prospecting and data quality
|
Legitimate interests (Art. 6(1)(f))
|
|
Testimonial data (e.g., Name, job title, company, photos, video and voice recordings, case study content, quote approvals)
|
Testimonials, case studies, sales enablement
|
Consent (Art. 6(1)(a))
|
2.5 Applies Across All Groups
-
Children. We do not knowingly collect personal data from anyone under 16.
-
Marketing based on legitimate interests. We use professional contact details and keep our messages relevant to your role. You can opt out at any time.
-
Providing data. Providing personal data is voluntary. Without required registration or payment details, we may be unable to register you for an event or pay you as a speaker.
-
Sensitive data. We do not collect sensitive personal information, as defined by US state privacy laws, through the activities described here.
-
Internal access. Access to your personal data is granted to our personnel strictly on a need-to-know, case-by-case basis.
-
Sources of personal data. We collect personal data from several sources, including:
-
Directly from you: When you visit our websites, fill out contact or demo forms, register for events, subscribe to newsletters, or communicate with us.
-
Automated technologies: Through cookies, analytics tools, and beacons when you browse our website or engage with our emails.
-
Third parties and partners: From your employer, event organizers, marketing agencies, sponsors, and our trusted service providers and data enrichment vendors (such as CRM and professional contact platforms).
3. Who We Share Data With
Our service providers process personal data only on our instructions and under written contracts.
|
Category
|
Provider
|
Function
|
Location
|
|
Website
|
Google (Analytics, Tag Manager); Mixpanel
|
Analytics
|
US
|
|
Website
|
Webflow; GitBook
|
Hosting
|
US
|
|
Website
|
RelyanceAI
|
Cookie consent and privacy requests
|
US
|
|
Events
|
Airmeet
|
Virtual events
|
US
|
|
Events
|
ZIP
|
Speaker payments
|
US
|
|
Events
|
Badge scanning providers; venue operators
|
In-person events
|
Varies
|
|
Marketing
|
Marketo (Adobe)
|
Marketing automation, forms, email
|
US
|
|
Marketing
|
Emailable
|
Email validation
|
US
|
|
Marketing
|
Sendoso
|
Direct mail
|
US
|
|
Marketing
|
Sweetlift, VIB, Sagetap
|
Marketing agencies
|
US
|
|
Sales and CRM
|
Salesforce
|
CRM
|
US
|
|
Sales and CRM
|
Openprise; DemandTools (Validity)
|
Data normalization and CRM data management
|
US
|
|
Sales and CRM
|
LeanData; Full Circle Insights; Domo
|
Lead routing, campaign analytics, reporting
|
US
|
|
Sales and CRM
|
Outreach; Qualified
|
Sales and website engagement
|
US
|
|
Sales and CRM
|
Upsell
|
LinkedIn contact import
|
Austria
|
Independent and joint controllers. Certain third-party platforms receive or process personal data as independent or joint controllers rather than as our service providers, such as:
- YouTube (Google) hosts our on-demand event videos as an independent controller.
- We act as joint controllers with LinkedIn (Microsoft) and Meta (Facebook and Instagram) for lead forms and advertising.
Each platform handles requests about its own processing. To learn more about their data practices, please consult their respective privacy policies.
Other recipients. We may also share personal data with:
- Harness affiliates;
- event sponsors and partners, with your consent, if required by law;
- auditors and professional advisors;
- public authorities, where the law requires it; and
- a buyer or successor in a merger, acquisition, or asset sale.
4. International Transfers
When we transfer data internally, we ensure appropriate and lawful safeguards are in place to protect your personal data. For transfers from the EEA, UK, or Switzerland, we use one of these safeguards may include:
- relevant adequacy decisions;
- the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified; or
- EU Standard Contractual Clauses, with the UK or Swiss Addendum where relevant;
- additional supplementary measures as may be necessary.
5. Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, protecting personal data against unauthorized or unlawful processing, accidental loss, destruction, alteration, or disclosure.
For more information on our security practices, please visit the Harness Trust Center
6. How Long We Keep Your Data
|
Data
|
Retention
|
|
Cookies and browsing data
|
See Cookie Notice
|
|
Contact form, CRM, and enrichment records
|
As long as needed to manage our relationship with you
|
|
Event data
|
Through event administration and initial follow-up, then as part of your CRM record
|
|
Speaker recordings and event media
|
Until the content remains published
|
|
Speaker payment data
|
As required by tax and accounting laws
|
|
Subscriber data
|
Until you remain subscribed
|
|
Testimonials and case study media
|
Until you withdraw consent or we retire the content
|
|
Consent and opt-out records
|
As long as needed to show compliance
|
We may keep data longer where required by law or to defend legal claims. Unsubscribing stops future marketing emails but does not automatically delete your data. To request personal data deletion, please visit the Harness Privacy Portal.
7. Automated Decision-Making
We do not make automated decisions that produce legal or similarly significant effects on you. We use lead scoring to help our sales team prioritize follow-up. A person is always involved before any action is taken based on a score. No decision about whether or how to contact you is made solely by automated means.
8. Your Choices and Rights
- Emails: Use the unsubscribe link in any marketing email, or update your preferences by visiting the Harness Subscription Center.
- Cookies and advertising: Choose your preferences via the cookie consent banner or select Cookie Settings in the website footer. We honor Global Privacy Control signals where the law requires it.
- Event photos and video: Inform our on-site staff before or during the event. You can also email the Harness Privacy Team afterward, and we will review requests about content we have already published.
Data Subject rights depend on where you are located. To exercise your rights, visit the Harness Privacy Portal or email the Harness Privacy Team. We will verify your identity before acting on a request. You may use an authorized agent where local law allows. We will not discriminate against you for exercising your rights.
|
Location
|
Data Subject Rights
|
Applicable Law
|
|
EEA / UK
|
Access, correction, deletion, restriction, portability, and objection. You can always object to direct marketing. You can withdraw consent at any time without affecting earlier processing.
|
GDPR / UK GDPR
|
|
United States
|
Access, correction, deletion, portability. You can opt out of targeted advertising, “sale,” and “sharing,” and appeal a denied request where state law provides for it.
|
CCPA and other state laws
|
|
Brazil
|
Confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing, consent revocation, review of automated decisions
|
LGPD
|
|
Singapore
|
Access, correction, withdrawal of consent
|
PDPA
|
|
Argentina
|
Access (free, every six months), rectification, suppression, information about purposes
|
Law 25.326
|
|
Canada
|
Access, correction, withdrawal of consent
|
PIPEDA
|
|
India
|
Access to a summary, correction, erasure, nomination of a representative, withdrawal of consent, redress through the Data Protection Board
|
DPDPA 2023
|
|
Japan
|
Disclosure, correction, deletion, cessation of use, cessation of third-party provision
|
APPI
|
|
Israel
|
Access, correction
|
Protection of Privacy Law
|
|
Serbia
|
Rights substantially similar to the GDPR
|
Law on Personal Data Protection
|
9. Complaints
If you believe we have not handled your personal data correctly, please contact the Harness Privacy Team first. You may also lodge a complaint with your local data protection authority. For individuals in the EEA, a list of supervisory authorities is available at edpb.europa.eu. For individuals in the UK, you may contact the Information Commissioner’s Office at ico.org.uk.
10. Changes
We may update this Privacy Statement from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this Privacy Statement periodically.