Cookies Policy
Effective August 21st 2024 to September 1st 2025
DownloadTable of Contents
Cookies Policy
Our Cookies Policy has moved to a new page and this page has been disabled. Please refer to the updated policy by clicking here.For any inquiries, don't hesitate to reach out to us. We appreciate your attention to this update.
Effective November 17th 2023 to August 21st 2024
DownloadTable of Contents
Cookies Policy
Our website https://www.wiz.io/ ("Website") uses cookies and similar files or technologies to automatically collect and store information about your computer, device, and Website usage, in order to improve their performance and enhance your user experience. We use the general term "cookies" in this policy to refer to these technologies and all such similar technologies that collect information automatically when you are using our Website where this policy is posted. You can find out more about cookies and how to control them in the information below.
If you do not accept the use of these cookies, please disable them using the instructions in this Cookies Policy or by changing your browser settings so that cookies from this Website cannot be placed on your computer or mobile device. Important: disabling certain cookies on this Website may cripple the user experience and other features on the Website, to the point of rendering them useless.
In this Cookies Policy, we use the term Wiz (and "we", "us" and "our") to refer to Wiz Inc. and our affiliates. Our Privacy Policy is available at https://www.wiz.io/privacy-policy.
What is a cookie?
Cookies are computer files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies can then be sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are widely used in order to make websites work, or to work more efficiently, as well as to provide information to the owners of the website.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving the user experience. Cookies may tell us, for example, whether you have visited our Website before or whether you are a new visitor.
There are two broad categories of cookies:
- First Party cookies, served directly by us to your computer or mobile device.
- Third Party cookies, which are served by a third party on our behalf. We use third party cookies for functionality, performance / analytics, marketing, unclassified and other technologies, and social media purposes.
Cookies can remain on your computer or mobile device for different periods of time. Some cookies are 'session cookies', meaning that they exist only while your browser is open. These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. They can be used by websites to recognize your computer when you open your browser and browse the Internet again.
What are web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are small graphics files that contain a unique identifier that enable us to recognize when someone has visited our website. This allows us, for example, to monitor the traffic patterns of users from one page within our website to another, to deliver or communicate with cookies, to understand whether you have come to our website from an online advertisement displayed on a third party website, to improve website performance and to measure the success of email marketing campaigns. In most instances, these technologies are reliant on cookies to function, and therefore declining cookies prevents them from functioning.
If you don't want your cookie information to be associated with your visits to these pages, you can set your browser to turn off cookies as described further below. If you turn off cookies, web beacon and other technologies will still detect your visits to our Website; however, they will not be associated with information otherwise stored in cookies.
Targeted advertising
Third parties may drop cookies on your computer or mobile device to serve advertising through our Website. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. The information collected through this process does not enable us or them to identify your name, contact details or other personally identifying details unless you choose to provide these to us.
How do we use cookies?
We use cookies to:
- track traffic flow and patterns of travel and behavior in connection with our Website;
- understand the total number of visitors to our Websites on an ongoing basis and the types of internet browsers (e.g. Chrome, Firefox, Safari, or Internet Explorer) and operating systems (e.g. Windows or Mac) used by our visitors;
- monitor the performance of our Website and to continually improve it;
- in connection with our marketing and advertising efforts; and
- customize and enhance your online experience.
What types of cookies do we use?
The types of cookies used by us in connection with the Website can be considered “strictly necessary”, “performance or analytics cookies”, “marketing / targeting”, and “unclassified”. We've set out some further information below about each category.
Cookies strictly necessary for website purposes
These cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to secure areas. These cookies cannot be switched as without them we will not be able to provide essential website services.
Cookie Name | Type | Lifespan |
OptanonAlertBoxClosed | 1st Party | 1 year |
OptanonConsent | 1st Party | 1 year |
Performance / Analytics Cookies
We use performance/analytics cookies to analyze how the website is accessed, used, or is performing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. For example, these cookies allow us to:
- Better understand our website visitors so that we can improve how we present our content;
- Test different design ideas for particular pages, such as our homepage;
- Collect information about Website visitors such as where they are located and what browsers they are using;
- Determine the number of unique users of the website;
- Improve the website by measuring any errors that occur;
- Measuring campaign effectiveness; and
- Conduct research and diagnostics to improve product offerings.
Cookie Name | Type | Lifespan |
_ga | 1st Party | 730 days |
_gid | 1st Party | 1 day |
_biz_sid | 1st Party | 0 days |
_biz_uid | 1st Party | 364 days |
_biz_nA | 1st Party | 364 days |
_biz_pendingA | 1st Party | 364 days |
_uetvid | 1st Party | 389 days |
_clsk | 1st Party | 0 days |
_session_id | 3rd Party | 13 days |
_clck | 1st Party | 364 days |
JSESSIONID | 3rd Party | 1 day |
_ga_xxxxxxx | 1st Party | 729 days |
ARRAffinity | 3rd Party | 0 days |
_gclxxxx | 1st Party | 90 days |
Functionality Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookie Name | Type | Lifespan |
_rdt_uuid | 1st Party | 90 days |
_gd_visitor | 1st Party | 730 days |
_gd_session | 1st Party | 0 days |
_mkto_trk | 1st Party | 730 days |
_an_uid | 1st Party | 6 days |
_gd_svisitor | 1st Party | 730 days |
vuid | 3rd party | 729 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
player | 3rd Party | 365 days |
__q_domainTest | 1st Party | 0 days |
Marketing / Targeting
We use marketing cookies to deliver many types of targeted digital marketing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. The cookie store user data and behavior information, which allows advertising services to target audience according to variables. For example, these cookies allow us to:
- Observe the Website performance and generate retargeting (Site retargeting, search retargeting, etc.).
- Maintain and improve the website and our products
Cookie Name | Type | Lifespan |
NO NAME | 3rd party | 0 days |
6suuid | 3rd party | 729 days |
lidc | 3rd party | 1 day |
_fbp | 1st Party | 90 days |
bcookie | 3rd party | 731 days |
bscookie | 3rd party | 731 days |
AnalyticsSyncHistory | 3rd party | 30 days |
UserMatchHistory | 3rd party | 30 days |
li_gc | 3rd party | 713 days |
_BUID | 3rd party | 364 days |
_biz_kvpA | 1st Party | 0 days |
_biz_dfsA | 1st Party | 0 days |
_BUID | 3rd party | 364 days |
VISITOR_INFO1_LIVE | 3rd party | 179 days |
YSC | 3rd party | 0 days |
CONSENT | 3rd party | 729 days |
_uetsid | 1st Party | 0 days |
ANONCHK | 3rd Party | 0 days |
SRM_B | 3rd Party | 389 days |
MUID | 3rd Party | 389 days |
SM | 3rd Party | 0 days |
muc_ads | 3rd Party | 729 days |
personalization_id | 3rd Party | 729 days |
in_or | 1st party | 0 days |
q_state_ubFjDH1QLqM69tJc | 1st Party | 3649 days |
_gat_UA-XXXXXX-X | 1st Party | 0 days |
_biz_flagsA | 1st Party | 364 days |
__cf_bm | 3rd Party | 0 days |
guest_id | 3rd Party | 729 days |
MR | 3rd Party | 6 days |
guest_id_ads | 3rd Party | 729 days |
_cfuvid | 3rd Party | 0 days |
li_sugr | 3rd Party | 89 days |
MUID | 3rd Party | 389 days |
guest_id_marketing | 3rd Party | 729 days |
ARRAffinitySameSite | 3rd Party | 0 days |
visitorId | 3rd Party | 364 days |
CLID | 3rd Party | 364 days |
MR | 3rd Party | 6 days |
CLID | 3rd Party | 364 days |
ARRAffinity | 3rd Party | 0 days |
MR | 3rd Party | 6 days |
How to control or delete cookies
Most browsers allow you to change your cookie settings. These settings will typically be found in the “options” or “preferences” menu of your browser. In order to understand these settings and learn how to use them, please consult the “Help” function of your browser, or the documentation published online for your particular browser type and version. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our Website.
Depending on where you are located, you may also be able to change your cookie preferences using the cookies banner on our Website.
The following pages have information on how to change your cookies settings for the different browsers:
- Cookie settings in Chrome
- Cookie settings in Firefox
- Cookie settings in Internet Explorer
- Cookie settings in Safari and iOS
Third Party Websites' Cookies
When using our Website you may be directed to other websites. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our Website.
If you use the buttons that allow you to share products and content with your friends via social networks like Google, Twitter and Facebook, these companies may set a cookie on your computer memory. Find out more about these here:
https://www.facebook.com/about/privacy http://twitter.com/privacy http://www.google.com/intl/en-GB/policies/privacy
Need More Information?
If you would like to find out more about cookies and their use on the Internet, you may find the following link useful: All About Cookies.
Cookies that have been set in the past
If you have disabled one or more Cookies, we may still use information collected from cookies prior to your disabled preference being set, however, we will stop using the disabled cookie to collect any further information.
Contact us
If you have any questions or comments about this cookies policy, or privacy matters generally, please contact us via email at privacy@wiz.io.
Updated 15 November 2023
Effective November 17th 2023 to November 17th 2023
DownloadTable of Contents
Cookies Policy
Our website https://www.wiz.io/ ("Website") uses cookies and similar files or technologies to automatically collect and store information about your computer, device, and Website usage, in order to improve their performance and enhance your user experience. We use the general term "cookies" in this policy to refer to these technologies and all such similar technologies that collect information automatically when you are using our Website where this policy is posted. You can find out more about cookies and how to control them in the information below.
If you do not accept the use of these cookies, please disable them using the instructions in this Cookies Policy or by changing your browser settings so that cookies from this Website cannot be placed on your computer or mobile device. Important: disabling certain cookies on this Website may cripple the user experience and other features on the Website, to the point of rendering them useless.
In this Cookies Policy, we use the term Wiz (and "we", "us" and "our") to refer to Wiz Inc. and our affiliates. Our Privacy Policy is available at https://www.wiz.io/privacy-policy.
What is a cookie?
Cookies are computer files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies can then be sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are widely used in order to make websites work, or to work more efficiently, as well as to provide information to the owners of the website.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving the user experience. Cookies may tell us, for example, whether you have visited our Website before or whether you are a new visitor.
There are two broad categories of cookies:
- First Party cookies, served directly by us to your computer or mobile device.
- Third Party cookies, which are served by a third party on our behalf. We use third party cookies for functionality, performance / analytics, marketing, unclassified and other technologies, and social media purposes.
Cookies can remain on your computer or mobile device for different periods of time. Some cookies are 'session cookies', meaning that they exist only while your browser is open. These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. They can be used by websites to recognize your computer when you open your browser and browse the Internet again.
What are web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are small graphics files that contain a unique identifier that enable us to recognize when someone has visited our website. This allows us, for example, to monitor the traffic patterns of users from one page within our website to another, to deliver or communicate with cookies, to understand whether you have come to our website from an online advertisement displayed on a third party website, to improve website performance and to measure the success of email marketing campaigns. In most instances, these technologies are reliant on cookies to function, and therefore declining cookies prevents them from functioning.
If you don't want your cookie information to be associated with your visits to these pages, you can set your browser to turn off cookies as described further below. If you turn off cookies, web beacon and other technologies will still detect your visits to our Website; however, they will not be associated with information otherwise stored in cookies.
Targeted advertising
Third parties may drop cookies on your computer or mobile device to serve advertising through our Website. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. The information collected through this process does not enable us or them to identify your name, contact details or other personally identifying details unless you choose to provide these to us.
How do we use cookies?
We use cookies to:
- track traffic flow and patterns of travel and behavior in connection with our Website;
- understand the total number of visitors to our Websites on an ongoing basis and the types of internet browsers (e.g. Chrome, Firefox, Safari, or Internet Explorer) and operating systems (e.g. Windows or Mac) used by our visitors;
- monitor the performance of our Website and to continually improve it;
- in connection with our marketing and advertising efforts; and
- customize and enhance your online experience.
What types of cookies do we use?
The types of cookies used by us in connection with the Website can be considered “strictly necessary”, “performance or analytics cookies”, “marketing / targeting”, and “unclassified”. We've set out some further information below about each category.
Cookies strictly necessary for website purposes
These cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to secure areas. These cookies cannot be switched as without them we will not be able to provide essential website services.
Cookie Name | Type | Lifespan |
OptanonAlertBoxClosed | 1st Party | 1 year |
OptanonConsent | 1st Party | 1 year |
Performance / Analytics Cookies
We use performance/analytics cookies to analyze how the website is accessed, used, or is performing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. For example, these cookies allow us to:
- Better understand our website visitors so that we can improve how we present our content;
- Test different design ideas for particular pages, such as our homepage;
- Collect information about Website visitors such as where they are located and what browsers they are using;
- Determine the number of unique users of the website;
- Improve the website by measuring any errors that occur;
- Measuring campaign effectiveness; and
- Conduct research and diagnostics to improve product offerings.
Cookie Name | Type | Lifespan |
_ga | 1st Party | 730 days |
_gid | 1st Party | 1 day |
_biz_sid | 1st Party | 0 days |
_biz_uid | 1st Party | 364 days |
_biz_nA | 1st Party | 364 days |
_biz_pendingA | 1st Party | 364 days |
_uetvid | 1st Party | 389 days |
_clsk | 1st Party | 0 days |
_session_id | 3rd Party | 13 days |
_clck | 1st Party | 364 days |
JSESSIONID | 3rd Party | 1 day |
_ga_xxxxxxx | 1st Party | 729 days |
ARRAffinity | 3rd Party | 0 days |
_gclxxxx | 1st Party | 90 days |
Functionality Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookie Name | Type | Lifespan |
_rdt_uuid | 1st Party | 90 days |
_gd_visitor | 1st Party | 730 days |
_gd_session | 1st Party | 0 days |
_mkto_trk | 1st Party | 730 days |
_an_uid | 1st Party | 6 days |
_gd_svisitor | 1st Party | 730 days |
vuid | 3rd party | 729 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
player | 3rd Party | 365 days |
__q_domainTest | 1st Party | 0 days |
Marketing / Targeting
We use marketing cookies to deliver many types of targeted digital marketing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. The cookie store user data and behavior information, which allows advertising services to target audience according to variables. For example, these cookies allow us to:
- Observe the Website performance and generate retargeting (Site retargeting, search retargeting, etc.).
- Maintain and improve the website and our products
Cookie Name | Type | Lifespan |
NO NAME | 3rd party | 0 days |
6suuid | 3rd party | 729 days |
lidc | 3rd party | 1 day |
_fbp | 1st Party | 90 days |
bcookie | 3rd party | 731 days |
bscookie | 3rd party | 731 days |
AnalyticsSyncHistory | 3rd party | 30 days |
UserMatchHistory | 3rd party | 30 days |
li_gc | 3rd party | 713 days |
_BUID | 3rd party | 364 days |
_biz_kvpA | 1st Party | 0 days |
_biz_dfsA | 1st Party | 0 days |
_BUID | 3rd party | 364 days |
VISITOR_INFO1_LIVE | 3rd party | 179 days |
YSC | 3rd party | 0 days |
CONSENT | 3rd party | 729 days |
_uetsid | 1st Party | 0 days |
ANONCHK | 3rd Party | 0 days |
SRM_B | 3rd Party | 389 days |
MUID | 3rd Party | 389 days |
SM | 3rd Party | 0 days |
muc_ads | 3rd Party | 729 days |
personalization_id | 3rd Party | 729 days |
in_or | 1st party | 0 days |
q_state_ubFjDH1QLqM69tJc | 1st Party | 3649 days |
_gat_UA-XXXXXX-X | 1st Party | 0 days |
_biz_flagsA | 1st Party | 364 days |
__cf_bm | 3rd Party | 0 days |
guest_id | 3rd Party | 729 days |
MR | 3rd Party | 6 days |
guest_id_ads | 3rd Party | 729 days |
_cfuvid | 3rd Party | 0 days |
li_sugr | 3rd Party | 89 days |
MUID | 3rd Party | 389 days |
guest_id_marketing | 3rd Party | 729 days |
ARRAffinitySameSite | 3rd Party | 0 days |
visitorId | 3rd Party | 364 days |
CLID | 3rd Party | 364 days |
MR | 3rd Party | 6 days |
CLID | 3rd Party | 364 days |
ARRAffinity | 3rd Party | 0 days |
MR | 3rd Party | 6 days |
How to control or delete cookies
Most browsers allow you to change your cookie settings. These settings will typically be found in the “options” or “preferences” menu of your browser. In order to understand these settings and learn how to use them, please consult the “Help” function of your browser, or the documentation published online for your particular browser type and version. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our Website.
Depending on where you are located, you may also be able to change your cookie preferences using the cookies banner on our Website.
The following pages have information on how to change your cookies settings for the different browsers:
- Cookie settings in Chrome
- Cookie settings in Firefox
- Cookie settings in Internet Explorer
- Cookie settings in Safari and iOS
Third Party Websites' Cookies
When using our Website you may be directed to other websites. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our Website.
If you use the buttons that allow you to share products and content with your friends via social networks like Google, Twitter and Facebook, these companies may set a cookie on your computer memory. Find out more about these here:
https://www.facebook.com/about/privacy http://twitter.com/privacy http://www.google.com/intl/en-GB/policies/privacy
Need More Information?
If you would like to find out more about cookies and their use on the Internet, you may find the following link useful: All About Cookies.
Cookies that have been set in the past
If you have disabled one or more Cookies, we may still use information collected from cookies prior to your disabled preference being set, however, we will stop using the disabled cookie to collect any further information.
Contact us
If you have any questions or comments about this cookies policy, or privacy matters generally, please contact us via email at privacy@wiz.io.
Updated 15 November 2023
Effective November 17th 2023 to November 17th 2023
DownloadTable of Contents
Cookies Policy
Our website https://www.wiz.io/ ("Website") uses cookies and similar files or technologies to automatically collect and store information about your computer, device, and Website usage, in order to improve their performance and enhance your user experience. We use the general term "cookies" in this policy to refer to these technologies and all such similar technologies that collect information automatically when you are using our Website where this policy is posted. You can find out more about cookies and how to control them in the information below.
If you do not accept the use of these cookies, please disable them using the instructions in this Cookies Policy or by changing your browser settings so that cookies from this Website cannot be placed on your computer or mobile device. Important: disabling certain cookies on this Website may cripple the user experience and other features on the Website, to the point of rendering them useless.
In this Cookies Policy, we use the term Wiz (and "we", "us" and "our") to refer to Wiz Inc. and our affiliates. Our Privacy Policy is available at https://legal.wiz.io/#privacy-policy.
What is a cookie?
Cookies are computer files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies can then be sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are widely used in order to make websites work, or to work more efficiently, as well as to provide information to the owners of the website.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving the user experience. Cookies may tell us, for example, whether you have visited our Website before or whether you are a new visitor.
There are two broad categories of cookies:
- First Party cookies, served directly by us to your computer or mobile device.
- Third Party cookies, which are served by a third party on our behalf. We use third party cookies for functionality, performance / analytics, marketing, unclassified and other technologies, and social media purposes.
Cookies can remain on your computer or mobile device for different periods of time. Some cookies are 'session cookies', meaning that they exist only while your browser is open. These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. They can be used by websites to recognize your computer when you open your browser and browse the Internet again.
What are web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are small graphics files that contain a unique identifier that enable us to recognize when someone has visited our website. This allows us, for example, to monitor the traffic patterns of users from one page within our website to another, to deliver or communicate with cookies, to understand whether you have come to our website from an online advertisement displayed on a third party website, to improve website performance and to measure the success of email marketing campaigns. In most instances, these technologies are reliant on cookies to function, and therefore declining cookies prevents them from functioning.
If you don't want your cookie information to be associated with your visits to these pages, you can set your browser to turn off cookies as described further below. If you turn off cookies, web beacon and other technologies will still detect your visits to our Website; however, they will not be associated with information otherwise stored in cookies.
Targeted advertising
Third parties may drop cookies on your computer or mobile device to serve advertising through our Website. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. The information collected through this process does not enable us or them to identify your name, contact details or other personally identifying details unless you choose to provide these to us.
How do we use cookies?
We use cookies to:
- track traffic flow and patterns of travel and behavior in connection with our Website;
- understand the total number of visitors to our Websites on an ongoing basis and the types of internet browsers (e.g. Chrome, Firefox, Safari, or Internet Explorer) and operating systems (e.g. Windows or Mac) used by our visitors;
- monitor the performance of our Website and to continually improve it;
- in connection with our marketing and advertising efforts; and
- customize and enhance your online experience.
What types of cookies do we use?
The types of cookies used by us in connection with the Website can be considered “strictly necessary”, “performance or analytics cookies”, “marketing / targeting”, and “unclassified”. We've set out some further information below about each category.
Cookies strictly necessary for website purposes
These cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to secure areas. These cookies cannot be switched as without them we will not be able to provide essential website services.
Cookie Name | Type | Lifespan |
OptanonAlertBoxClosed | 1st Party | 1 year |
OptanonConsent | 1st Party | 1 year |
Performance / Analytics Cookies
We use performance/analytics cookies to analyze how the website is accessed, used, or is performing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. For example, these cookies allow us to:
- Better understand our website visitors so that we can improve how we present our content;
- Test different design ideas for particular pages, such as our homepage;
- Collect information about Website visitors such as where they are located and what browsers they are using;
- Determine the number of unique users of the website;
- Improve the website by measuring any errors that occur;
- Measuring campaign effectiveness; and
- Conduct research and diagnostics to improve product offerings.
Cookie Name | Type | Lifespan |
_ga | 1st Party | 730 days |
_gid | 1st Party | 1 day |
_biz_sid | 1st Party | 0 days |
_biz_uid | 1st Party | 364 days |
_biz_nA | 1st Party | 364 days |
_biz_pendingA | 1st Party | 364 days |
_uetvid | 1st Party | 389 days |
_clsk | 1st Party | 0 days |
_session_id | 3rd Party | 13 days |
_clck | 1st Party | 364 days |
JSESSIONID | 3rd Party | 1 day |
_ga_xxxxxxx | 1st Party | 729 days |
ARRAffinity | 3rd Party | 0 days |
_gclxxxx | 1st Party | 90 days |
Functionality Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookie Name | Type | Lifespan |
_rdt_uuid | 1st Party | 90 days |
_gd_visitor | 1st Party | 730 days |
_gd_session | 1st Party | 0 days |
_mkto_trk | 1st Party | 730 days |
_an_uid | 1st Party | 6 days |
_gd_svisitor | 1st Party | 730 days |
vuid | 3rd party | 729 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
player | 3rd Party | 365 days |
__q_domainTest | 1st Party | 0 days |
Marketing / Targeting
We use marketing cookies to deliver many types of targeted digital marketing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. The cookie store user data and behavior information, which allows advertising services to target audience according to variables. For example, these cookies allow us to:
- Observe the Website performance and generate retargeting (Site retargeting, search retargeting, etc.).
- Maintain and improve the website and our products
Cookie Name | Type | Lifespan |
NO NAME | 3rd party | 0 days |
6suuid | 3rd party | 729 days |
lidc | 3rd party | 1 day |
_fbp | 1st Party | 90 days |
bcookie | 3rd party | 731 days |
bscookie | 3rd party | 731 days |
AnalyticsSyncHistory | 3rd party | 30 days |
UserMatchHistory | 3rd party | 30 days |
li_gc | 3rd party | 713 days |
_BUID | 3rd party | 364 days |
_biz_kvpA | 1st Party | 0 days |
_biz_dfsA | 1st Party | 0 days |
_BUID | 3rd party | 364 days |
VISITOR_INFO1_LIVE | 3rd party | 179 days |
YSC | 3rd party | 0 days |
CONSENT | 3rd party | 729 days |
_uetsid | 1st Party | 0 days |
ANONCHK | 3rd Party | 0 days |
SRM_B | 3rd Party | 389 days |
MUID | 3rd Party | 389 days |
SM | 3rd Party | 0 days |
muc_ads | 3rd Party | 729 days |
personalization_id | 3rd Party | 729 days |
in_or | 1st party | 0 days |
q_state_ubFjDH1QLqM69tJc | 1st Party | 3649 days |
_gat_UA-XXXXXX-X | 1st Party | 0 days |
_biz_flagsA | 1st Party | 364 days |
__cf_bm | 3rd Party | 0 days |
guest_id | 3rd Party | 729 days |
MR | 3rd Party | 6 days |
guest_id_ads | 3rd Party | 729 days |
_cfuvid | 3rd Party | 0 days |
li_sugr | 3rd Party | 89 days |
MUID | 3rd Party | 389 days |
guest_id_marketing | 3rd Party | 729 days |
ARRAffinitySameSite | 3rd Party | 0 days |
visitorId | 3rd Party | 364 days |
CLID | 3rd Party | 364 days |
MR | 3rd Party | 6 days |
CLID | 3rd Party | 364 days |
ARRAffinity | 3rd Party | 0 days |
MR | 3rd Party | 6 days |
How to control or delete cookies
Most browsers allow you to change your cookie settings. These settings will typically be found in the “options” or “preferences” menu of your browser. In order to understand these settings and learn how to use them, please consult the “Help” function of your browser, or the documentation published online for your particular browser type and version. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our Website.
Depending on where you are located, you may also be able to change your cookie preferences using the cookies banner on our Website.
The following pages have information on how to change your cookies settings for the different browsers:
- Cookie settings in Chrome
- Cookie settings in Firefox
- Cookie settings in Internet Explorer
- Cookie settings in Safari and iOS
Third Party Websites' Cookies
When using our Website you may be directed to other websites. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our Website.
If you use the buttons that allow you to share products and content with your friends via social networks like Google, Twitter and Facebook, these companies may set a cookie on your computer memory. Find out more about these here:
https://www.facebook.com/about/privacy http://twitter.com/privacy http://www.google.com/intl/en-GB/policies/privacy
Need More Information?
If you would like to find out more about cookies and their use on the Internet, you may find the following link useful: All About Cookies.
Cookies that have been set in the past
If you have disabled one or more Cookies, we may still use information collected from cookies prior to your disabled preference being set, however, we will stop using the disabled cookie to collect any further information.
Contact us
If you have any questions or comments about this cookies policy, or privacy matters generally, please contact us via email at privacy@wiz.io.
Updated 15 November 2023
Effective November 15th 2023 to November 17th 2023
DownloadTable of Contents
Cookies Policy
Our website https://www.wiz.io/ ("Website") uses cookies and similar files or technologies to automatically collect and store information about your computer, device, and Website usage, in order to improve their performance and enhance your user experience. We use the general term "cookies" in this policy to refer to these technologies and all such similar technologies that collect information automatically when you are using our Website where this policy is posted. You can find out more about cookies and how to control them in the information below.
If you do not accept the use of these cookies, please disable them using the instructions in this Cookies Policy or by changing your browser settings so that cookies from this Website cannot be placed on your computer or mobile device. Important: disabling certain cookies on this Website may cripple the user experience and other features on the Website, to the point of rendering them useless.
In this Cookies Policy, we use the term Wiz (and "we", "us" and "our") to refer to Wiz Inc. and our affiliates. Our Privacy Policy is available at https://www.wiz.io/legal/privacy-policy.
What is a cookie?
Cookies are computer files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies can then be sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are widely used in order to make websites work, or to work more efficiently, as well as to provide information to the owners of the website.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving the user experience. Cookies may tell us, for example, whether you have visited our Website before or whether you are a new visitor.
There are two broad categories of cookies:
- First Party cookies, served directly by us to your computer or mobile device.
- Third Party cookies, which are served by a third party on our behalf. We use third party cookies for functionality, performance / analytics, marketing, unclassified and other technologies, and social media purposes.
Cookies can remain on your computer or mobile device for different periods of time. Some cookies are 'session cookies', meaning that they exist only while your browser is open. These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. They can be used by websites to recognize your computer when you open your browser and browse the Internet again.
What are web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are small graphics files that contain a unique identifier that enable us to recognize when someone has visited our website. This allows us, for example, to monitor the traffic patterns of users from one page within our website to another, to deliver or communicate with cookies, to understand whether you have come to our website from an online advertisement displayed on a third party website, to improve website performance and to measure the success of email marketing campaigns. In most instances, these technologies are reliant on cookies to function, and therefore declining cookies prevents them from functioning.
If you don't want your cookie information to be associated with your visits to these pages, you can set your browser to turn off cookies as described further below. If you turn off cookies, web beacon and other technologies will still detect your visits to our Website; however, they will not be associated with information otherwise stored in cookies.
Targeted advertising
Third parties may drop cookies on your computer or mobile device to serve advertising through our Website. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. The information collected through this process does not enable us or them to identify your name, contact details or other personally identifying details unless you choose to provide these to us.
How do we use cookies?
We use cookies to:
- track traffic flow and patterns of travel and behavior in connection with our Website;
- understand the total number of visitors to our Websites on an ongoing basis and the types of internet browsers (e.g. Chrome, Firefox, Safari, or Internet Explorer) and operating systems (e.g. Windows or Mac) used by our visitors;
- monitor the performance of our Website and to continually improve it;
- in connection with our marketing and advertising efforts; and
- customize and enhance your online experience.
What types of cookies do we use?
The types of cookies used by us in connection with the Website can be considered “strictly necessary”, “performance or analytics cookies”, “marketing / targeting”, and “unclassified”. We've set out some further information below about each category.
Cookies strictly necessary for website purposes
These cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to secure areas. These cookies cannot be switched as without them we will not be able to provide essential website services.
Cookie Name | Type | Lifespan |
OptanonAlertBoxClosed | 1st Party | 1 year |
OptanonConsent | 1st Party | 1 year |
Performance / Analytics Cookies
We use performance/analytics cookies to analyze how the website is accessed, used, or is performing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. For example, these cookies allow us to:
- Better understand our website visitors so that we can improve how we present our content;
- Test different design ideas for particular pages, such as our homepage;
- Collect information about Website visitors such as where they are located and what browsers they are using;
- Determine the number of unique users of the website;
- Improve the website by measuring any errors that occur;
- Measuring campaign effectiveness; and
- Conduct research and diagnostics to improve product offerings.
Cookie Name | Type | Lifespan |
_ga | 1st Party | 730 days |
_gid | 1st Party | 1 day |
_biz_sid | 1st Party | 0 days |
_biz_uid | 1st Party | 364 days |
_biz_nA | 1st Party | 364 days |
_biz_pendingA | 1st Party | 364 days |
_uetvid | 1st Party | 389 days |
_clsk | 1st Party | 0 days |
_session_id | 3rd Party | 13 days |
_clck | 1st Party | 364 days |
JSESSIONID | 3rd Party | 1 day |
_ga_xxxxxxx | 1st Party | 729 days |
ARRAffinity | 3rd Party | 0 days |
_gclxxxx | 1st Party | 90 days |
Functionality Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookie Name | Type | Lifespan |
_rdt_uuid | 1st Party | 90 days |
_gd_visitor | 1st Party | 730 days |
_gd_session | 1st Party | 0 days |
_mkto_trk | 1st Party | 730 days |
_an_uid | 1st Party | 6 days |
_gd_svisitor | 1st Party | 730 days |
vuid | 3rd party | 729 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
__cf_bm | 3rd party | 0 days |
player | 3rd Party | 365 days |
__q_domainTest | 1st Party | 0 days |
Marketing / Targeting
We use marketing cookies to deliver many types of targeted digital marketing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. The cookie store user data and behavior information, which allows advertising services to target audience according to variables. For example, these cookies allow us to:
- Observe the Website performance and generate retargeting (Site retargeting, search retargeting, etc.).
- Maintain and improve the website and our products
Cookie Name | Type | Lifespan |
NO NAME | 3rd party | 0 days |
6suuid | 3rd party | 729 days |
lidc | 3rd party | 1 day |
_fbp | 1st Party | 90 days |
bcookie | 3rd party | 731 days |
bscookie | 3rd party | 731 days |
AnalyticsSyncHistory | 3rd party | 30 days |
UserMatchHistory | 3rd party | 30 days |
li_gc | 3rd party | 713 days |
_BUID | 3rd party | 364 days |
_biz_kvpA | 1st Party | 0 days |
_biz_dfsA | 1st Party | 0 days |
_BUID | 3rd party | 364 days |
VISITOR_INFO1_LIVE | 3rd party | 179 days |
YSC | 3rd party | 0 days |
CONSENT | 3rd party | 729 days |
_uetsid | 1st Party | 0 days |
ANONCHK | 3rd Party | 0 days |
SRM_B | 3rd Party | 389 days |
MUID | 3rd Party | 389 days |
SM | 3rd Party | 0 days |
muc_ads | 3rd Party | 729 days |
personalization_id | 3rd Party | 729 days |
in_or | 1st party | 0 days |
q_state_ubFjDH1QLqM69tJc | 1st Party | 3649 days |
_gat_UA-XXXXXX-X | 1st Party | 0 days |
_biz_flagsA | 1st Party | 364 days |
__cf_bm | 3rd Party | 0 days |
guest_id | 3rd Party | 729 days |
MR | 3rd Party | 6 days |
guest_id_ads | 3rd Party | 729 days |
_cfuvid | 3rd Party | 0 days |
li_sugr | 3rd Party | 89 days |
MUID | 3rd Party | 389 days |
guest_id_marketing | 3rd Party | 729 days |
ARRAffinitySameSite | 3rd Party | 0 days |
visitorId | 3rd Party | 364 days |
CLID | 3rd Party | 364 days |
MR | 3rd Party | 6 days |
CLID | 3rd Party | 364 days |
ARRAffinity | 3rd Party | 0 days |
MR | 3rd Party | 6 days |
How to control or delete cookies
Most browsers allow you to change your cookie settings. These settings will typically be found in the “options” or “preferences” menu of your browser. In order to understand these settings and learn how to use them, please consult the “Help” function of your browser, or the documentation published online for your particular browser type and version. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our Website.
Depending on where you are located, you may also be able to change your cookie preferences using the cookies banner on our Website.
The following pages have information on how to change your cookies settings for the different browsers:
- Cookie settings in Chrome
- Cookie settings in Firefox
- Cookie settings in Internet Explorer
- Cookie settings in Safari and iOS
Third Party Websites' Cookies
When using our Website you may be directed to other websites. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our Website.
If you use the buttons that allow you to share products and content with your friends via social networks like Google, Twitter and Facebook, these companies may set a cookie on your computer memory. Find out more about these here:
https://www.facebook.com/about/privacy http://twitter.com/privacy http://www.google.com/intl/en-GB/policies/privacy
Need More Information?
If you would like to find out more about cookies and their use on the Internet, you may find the following link useful: All About Cookies.
Cookies that have been set in the past
If you have disabled one or more Cookies, we may still use information collected from cookies prior to your disabled preference being set, however, we will stop using the disabled cookie to collect any further information.
Contact us
If you have any questions or comments about this cookies policy, or privacy matters generally, please contact us via email at privacy@wiz.io.
Updated 15 November 2023
Effective October 9th 2023 to November 15th 2023
DownloadTable of Contents
Cookies Policy
Our website https://www.wiz.io/ ("Website") uses cookies and similar files or technologies to automatically collect and store information about your computer, device, and Website usage, in order to improve their performance and enhance your user experience. We use the general term "cookies" in this policy to refer to these technologies and all such similar technologies that collect information automatically when you are using our Website where this policy is posted. You can find out more about cookies and how to control them in the information below.
If you do not accept the use of these cookies, please disable them using the instructions in this Cookies Policy or by changing your browser settings so that cookies from this Website cannot be placed on your computer or mobile device. Important: disabling certain cookies on this Website may cripple the user experience and other features on the Website, to the point of rendering them useless.
In this Cookies Policy, we use the term Wiz (and "we", "us" and "our") to refer to Wiz Inc. and our affiliates. Our Privacy Policy is available at https://www.wiz.io/privacy-policy.
åWhat is a cookie?
Cookies are computer files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies can then be sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are widely used in order to make websites work, or to work more efficiently, as well as to provide information to the owners of the website.
Cookies do lots of different jobs, like letting you navigate between pages efficiently, remembering your preferences and generally improving the user experience. Cookies may tell us, for example, whether you have visited our Website before or whether you are a new visitor.
There are two broad categories of cookies:
- First Party cookies, served directly by us to your computer or mobile device.
- Third Party cookies, which are served by a third party on our behalf. We use third party cookies for functionality, performance / analytics, marketing, unclassified and other technologies, and social media purposes.
Cookies can remain on your computer or mobile device for different periods of time. Some cookies are 'session cookies', meaning that they exist only while your browser is open. These are deleted automatically once you close your browser. Other cookies are 'permanent cookies', meaning that they survive after your browser is closed. They can be used by websites to recognize your computer when you open your browser and browse the Internet again.
What are web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs"). These are small graphics files that contain a unique identifier that enable us to recognize when someone has visited our website. This allows us, for example, to monitor the traffic patterns of users from one page within our website to another, to deliver or communicate with cookies, to understand whether you have come to our website from an online advertisement displayed on a third party website, to improve website performance and to measure the success of email marketing campaigns. In most instances, these technologies are reliant on cookies to function, and therefore declining cookies prevents them from functioning.
If you don't want your cookie information to be associated with your visits to these pages, you can set your browser to turn off cookies as described further below. If you turn off cookies, web beacon and other technologies will still detect your visits to our Website; however, they will not be associated with information otherwise stored in cookies.
Targeted advertising
Third parties may drop cookies on your computer or mobile device to serve advertising through our Website. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and services that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements. The information collected through this process does not enable us or them to identify your name, contact details or other personally identifying details unless you choose to provide these to us.
How do we use cookies?
We use cookies to:
- track traffic flow and patterns of travel and behavior in connection with our Website;
- understand the total number of visitors to our Websites on an ongoing basis and the types of internet browsers (e.g. Chrome, Firefox, Safari, or Internet Explorer) and operating systems (e.g. Windows or Mac) used by our visitors;
- monitor the performance of our Website and to continually improve it;
- in connection with our marketing and advertising efforts; and
- customize and enhance your online experience.
What types of cookies do we use?
The types of cookies used by us in connection with the Website can be considered “strictly necessary”, “performance or analytics cookies”, “marketing / targeting”, and “unclassified”. We've set out some further information below about each category.
Cookies strictly necessary for website purposes
These cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to secure areas. These cookies cannot be switched as without them we will not be able to provide essential website services.
Cookie Name | Type | Lifespan |
OptanonAlertBoxClosed | 1st Party | 1 year |
OptanonConsent | 1st Party | 1 year |
Performance / Analytics Cookies
We use performance/analytics cookies to analyze how the website is accessed, used, or is performing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. For example, these cookies allow us to:
- Better understand our website visitors so that we can improve how we present our content;
- Test different design ideas for particular pages, such as our homepage;
- Collect information about Website visitors such as where they are located and what browsers they are using;
- Determine the number of unique users of the website;
- Improve the website by measuring any errors that occur;
- Measuring campaign effectiveness; and
- Conduct research and diagnostics to improve product offerings.
Cookie Name | Type | Lifespan |
---|---|---|
_ga | 1st Party | 730 days |
_gid | 1st Party | 1 day |
_biz_sid | 1st Party | 0 days |
_biz_uid | 1st Party | 364 days |
_biz_nA | 1st Party | 364 days |
_biz_pendingA | 1st Party | 364 days |
_uetvid | 1st Party | 389 days |
_clsk | 1st Party | 0 days |
_session_id | 3rd Party | 13 days |
_clck | 1st Party | 364 days |
JSESSIONID | 3rd Party | 1 day |
_ga_xxxxxxx | 1st Party | 729 days |
ARRAffinity | 3rd Party | 0 days |
Functionality Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
Cookie Name | Type | Lifespan |
_rdt_uuid | 1st Party | 90 days |
_gd_visitor | 1st Party | 730 days |
_gd_session | 1st Party | 0 days |
_mkto_trk | 1st Party | 730 days |
_an_uid | 1st Party | 6 days |
_gd_svisitor | 1st Party | 730 days |
vuid | 3rd party | 729 days |
__cf_bm | 3rd party | 0 days |
player | 3rd Party | 365 days |
__q_domainTest | 1st Party | 0 days |
Marketing / Targeting
We use marketing cookies to deliver many types of targeted digital marketing. We do this in order to provide you with a better user experience and to maintain, operate and continually improve the website. The cookie store user data and behavior information, which allows advertising services to target audience according to variables. For example, these cookies allow us to:
- Observe the Website performance and generate retargeting (Site retargeting, search retargeting, etc.).
- Maintain and improve the website and our products
Cookie Name | Type | Lifespan |
NO NAME | 3rd party | 0 days |
6suuid | 3rd party | 729 days |
lidc | 3rd party | 1 day |
_fbp | 1st Party | 90 days |
bcookie | 3rd party | 731 days |
bscookie | 3rd party | 731 days |
AnalyticsSyncHistory | 3rd party | 30 days |
UserMatchHistory | 3rd party | 30 days |
li_gc | 3rd party | 713 days |
_BUID | 3rd party | 364 days |
_biz_kvpA | 1st Party | 0 days |
_biz_dfsA | 1st Party | 0 days |
_BUID | 3rd party | 364 days |
VISITOR_INFO1_LIVE | 3rd party | 179 days |
YSC | 3rd party | 0 days |
CONSENT | 3rd party | 729 days |
_uetsid | 1st Party | 0 days |
ANONCHK | 3rd Party | 0 days |
SRM_B | 3rd Party | 389 days |
MUID | 3rd Party | 389 days |
SM | 3rd Party | 0 days |
muc_ads | 3rd Party | 729 days |
personalization_id | 3rd Party | 729 days |
in_or | 1st party | 0 days |
q_state_ubFjDH1QLqM69tJc | 1st Party | 3649 days |
_gat_UA-XXXXXX-X | 1st Party | 0 days |
_biz_flagsA | 1st Party | 364 days |
__cf_bm | 3rd Party | 0 days |
guest_id | 3rd Party | 729 days |
MR | 3rd Party | 6 days |
guest_id_ads | 3rd Party | 729 days |
_cfuvid | 3rd Party | 0 days |
li_sugr | 3rd Party | 89 days |
MUID | 3rd Party | 389 days |
guest_id_marketing | 3rd Party | 729 days |
ARRAffinitySameSite | 3rd Party | 0 days |
visitorId | 3rd Party | 364 days |
CLID | 3rd Party | 364 days |
MR | 3rd Party | 6 days |
How to control or delete cookies
Most browsers allow you to change your cookie settings. These settings will typically be found in the “options” or “preferences” menu of your browser. In order to understand these settings and learn how to use them, please consult the “Help” function of your browser, or the documentation published online for your particular browser type and version. However, please note that if you choose to refuse cookies you may not be able to use the full functionality of our Website.
Depending on where you are located, you may also be able to change your cookie preferences using the cookies banner on our Website.
The following pages have information on how to change your cookies settings for the different browsers:
- Cookie settings in Chrome
- Cookie settings in Firefox
- Cookie settings in Internet Explorer
- Cookie settings in Safari and iOS
Third Party Websites' Cookies
When using our Website you may be directed to other websites. These websites may use their own cookies. We do not have control over the placement of cookies by other websites you visit, even if you are directed to them from our Website.
If you use the buttons that allow you to share products and content with your friends via social networks like Google, Twitter and Facebook, these companies may set a cookie on your computer memory. Find out more about these here:
https://www.facebook.com/about/privacy http://twitter.com/privacy http://www.google.com/intl/en-GB/policies/privacy
Need More Information?
If you would like to find out more about cookies and their use on the Internet, you may find the following link useful: All About Cookies.
Cookies that have been set in the past
If you have disabled one or more Cookies, we may still use information collected from cookies prior to your disabled preference being set, however, we will stop using the disabled cookie to collect any further information.
Contact us
If you have any questions or comments about this cookies policy, or privacy matters generally, please contact us via email at privacy@wiz.io.
Updated 17 July 2023
Terms of Use
Effective June 20th 2024
DownloadTable of Contents
Wiz Website Terms of Use
Welcome to https://www.wiz.io/ (together with its subdomains, Content, Marks and services, the “Website”). Please read the following Terms of Use carefully before using this Website so that you are aware of your legal rights and obligations with respect to Wiz Inc. ("Wiz", "we", "our" or "us"). By accessing or using the Website, you expressly acknowledge and agree that you are entering a legal agreement with us and have understood and agree to comply with, and be legally bound by, these Terms of Use, together with our Privacy Policy (collectively the "Terms"). If you do not agree to be bound by these Terms please do not access or use the Website.
PLEASE ALSO READ THESE TERMS OF USE CAREFULLY, AS THEY AFFECT YOUR LEGAL RIGHTS AND OBLIGATIONS. PLEASE NOTE THAT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, THESE TERMS REQUIRE THE USE OF ARBITRATION ON AN INDIVIDUAL BASIS TO RESOLVE DISPUTES, RATHER THAN COURTS OR JURY TRIALS, AND LIMIT THE REMEDIES AVAILABLE IN THE EVENT OF A DISPUTE.
1. Background. The Website is intended to provide you with information related to our products and services and to enable you to contact us via the Website.
2. Modification. We reserve the right, at our discretion, to change these Terms at any time. Such change will be effective ten (10) days following the posting of the revised Terms on the Website, and your continued use of the Website thereafter means that you accept those changes.
3. Ability to Accept Terms. The Website is only intended for individuals aged eighteen (18) years or older. If you are under eighteen (18) years old please do not visit or use the Website.
4. Website Access. For such time as these Terms are in effect, we hereby grant you permission to visit and use the Website, provided that you comply with these Terms and applicable laws.
5. Restrictions. You shall not: (i) copy, distribute or modify any part of the Website without our prior written authorization; (ii) use, modify, create derivative works of, transfer (by sale, resale, license, sublicense, download or otherwise), reproduce, distribute, display or disclose Content (defined below), except as expressly authorized herein; (iii) disrupt servers or networks connected to the Website; (iv) use or launch any automated system (including without limitation, "robots" and "spiders") to access the Website; and/or (v) circumvent, disable or otherwise interfere with security-related features of the Website or features that prevent or restrict use or copying of any Content or that enforce limitations on use of the Website.
6. Intellectual Property Rights.
6.1. Content and Marks. The (i) content on the Website, including without limitation, the text, documents, articles, brochures, descriptions, products, software, graphics, photos, sounds, videos, interactive features, and services (collectively, the "Content"), and (ii) the trademarks, service marks and logos contained therein ("Marks"), are the property of Wiz and/or its licensors and may be protected by applicable copyright or other intellectual property laws and treaties. “Wiz”, the Wiz logo, and other marks are Marks of Wiz or its affiliates. All other trademarks, service marks, and logos used on the Website are the trademarks, service marks, or logos of their respective owners. We reserve all rights not expressly granted in and to the Website and the Content.
6.2. Use of Content. Content on the Website is provided to you for your information and personal use only and may not be used, modified, copied, distributed, transmitted, broadcast, displayed, sold, licensed, de-compiled, or otherwise exploited for any other purposes whatsoever without our prior written consent. If you download or print a copy of the Content you must retain all copyright and other proprietary notices contained therein.
6.3. Spam. You agree not to, and will not, use the communication systems provided by the Website to send unauthorized commercial communications and you shall be solely responsible and liable for any such unauthorized communications.
7. Information Description. We attempt to be as accurate as possible. However, we cannot and do not warrant that the Content available on the Website is accurate, complete, reliable, current, or error-free. We reserve the right to make changes in or to the Content, or any part thereof, in our sole judgment, without the requirement of giving any notice prior to or after making such changes to the Content. Your use of the Content, or any part thereof, is made solely at your own risk and responsibility.
8. Links.
8.1. The Website may contain links, and may enable you to post content, to third party websites that are not owned or controlled by Wiz. We are not affiliated with, have no control over, and assume no responsibility for the content, privacy policies, or practices of, any third party websites. You: (i) are solely responsible and liable for your use of and linking to third party websites and any content that you may send or post to a third party website; and (ii) expressly release Wiz from any and all liability arising from your use of any third party website. Accordingly, we encourage you to read the terms and conditions and privacy policy of each third party website that you may choose to visit.
8.2. Wiz permits you to link to the Website provided that: (i) you link to but do not replicate any page on this Website; (ii) the hyperlink text shall accurately describe the Content as it appears on the Website; (iii) you shall not misrepresent your relationship with Wiz or present any false information about Wiz and shall not imply in any way that we are endorsing any services or products, unless we have given you our express prior consent; (iv) you shall not link from a website ("Third Party Website") which prohibits linking to third parties; (v) such Third Party Website does not contain content that (a) is offensive or controversial (both at our discretion), or (b) infringes any intellectual property, privacy rights, or other rights of any person or entity; and/or (vi) you, and your website, comply with these Terms and applicable law.
9. Privacy. We will use any personal information that we may collect or obtain in connection with the Website in accordance with our privacy policy which is available at: https://www.wiz.io/legal/privacy.
10. Warranty Disclaimers.
10.1. This section applies whether or not the services provided under the Website are for payment. Applicable law may not allow the exclusion of certain warranties, so to that extent certain exclusions set forth herein may not apply.
10.2. THE WEBSITE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, AND WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESS OR IMPLIED. WIZ HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND THOSE ARISING BY STATUTE OR FROM A COURSE OF DEALING OR USAGE OF TRADE. WIZ DOES NOT GUARANTEE THAT THE WEBSITE WILL BE FREE OF BUGS, SECURITY BREACHES, OR VIRUS ATTACKS. THE WEBSITE MAY OCCASIONALLY BE UNAVAILABLE FOR ROUTINE MAINTENANCE, UPGRADING, OR OTHER REASONS. YOU AGREE THAT WIZ WILL NOT BE HELD RESPONSIBLE FOR ANY CONSEQUENCES TO YOU OR ANY THIRD PARTY THAT MAY RESULT FROM TECHNICAL PROBLEMS OF THE INTERNET, SLOW CONNECTIONS, TRAFFIC CONGESTION OR OVERLOAD OF OUR OR OTHER SERVERS. WE DO NOT WARRANT, ENDORSE OR GUARANTEE ANY CONTENT, PRODUCT, OR SERVICE THAT IS FEATURED OR ADVERTISED ON THE WEBSITE BY A THIRD PARTY.
10.3. EXCEPT AS EXPRESSLY STATED IN OUR PRIVACY POLICY, WIZ DOES NOT MAKE ANY REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE SECURITY OF ANY INFORMATION YOU MAY PROVIDE OR ACTIVITIES YOU ENGAGE IN DURING THE COURSE OF YOUR USE OF THE WEBSITE.
11. Limitation of Liability.
11.1. TO THE FULLEST EXTENT PERMISSIBLE BY LAW, WIZ SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, EXEMPLARY, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES OF ANY KIND, OR FOR ANY LOSS OF DATA, REVENUE, PROFITS OR REPUTATION, ARISING UNDER THESE TERMS OR OUT OF YOUR USE OF, OR INABILITY TO USE, THE WEBSITE, EVEN IF WIZ HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES. Some jurisdictions do not allow the limitation or exclusion of liability for incidental or consequential damages, so the above limitations may not apply to you.
11.2. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF WIZ FOR ANY DAMAGES ARISING UNDER THESE TERMS OR OUT OF YOUR USE OF, OR INABILITY TO USE THE WEBSITE, EXCEED THE TOTAL AMOUNT OF FEES, IF ANY, PAID BY YOU TO WIZ FOR USING THE WEBSITE DURING THE THREE (3) MONTHS PRIOR TO BRINGING THE CLAIM.
12. Indemnity. You agree to defend, indemnify and hold harmless Wiz and our affiliates, and our respective officers, directors, employees and agents, from and against any and all claims, damages, obligations, losses, liabilities, costs and expenses (including but not limited to attorney's fees) arising from: (i) your use of, or inability to use, the Website; (ii) your interaction with any Website user; or (iii) your violation of these Terms.
13. Dispute Resolution: PLEASE READ THIS “DISPUTE RESOLUTION” SECTION CAREFULLY, AS IT MAY SIGNIFICANTLY AFFECT YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE OR PARTICIPATE IN A LAWSUIT FILED IN COURT.
13.1. Informal dispute resolution procedure. If a dispute arises between you and Wiz, we are committed to working with you to reach a reasonable resolution. For any such dispute, both parties acknowledge and agree that they will first make a good faith effort to resolve it informally before initiating any formal dispute resolution proceeding in arbitration or otherwise. This requires first sending a written description of the dispute to the other party. For any dispute you initiate, you agree to send the written description of the dispute along with the email address associated with your account, if any, to the following email address: legalnotices@wiz.io. For any dispute that Wiz initiates, we will send our written description of the dispute to the email address associated with your Wiz account (if any) or to any email address we have on file for you. The written description must be on an individual basis and provide, at minimum, the following information: your name; a description of the nature or basis of the claim or dispute; and the specific relief sought. If the dispute is not resolved within sixty (60) days after receipt of the written description of the dispute, you and Wiz agree to the further dispute resolution provisions below.
The above process for an informal dispute resolution process is required before you may commence any formal dispute resolution proceeding. The parties agree that any relevant limitations period and filing fees or other deadlines will be tolled while the parties engage in this informal dispute resolution process.
13.2. Mutual arbitration agreement. You and Wiz agree that all claims, disputes, or disagreements that may arise out of the interpretation or performance of these Terms (including its formation, performance, and breach) or payments by or to Wiz, or that in any way relate to the provision or use of the Website, your relationship with Wiz, or any other dispute with Wiz, shall be resolved exclusively through binding arbitration in accordance with this Section 13 (collectively, the “Arbitration Agreement”). This includes claims that arose, were asserted, or involve facts occurring before the existence of this Arbitration Agreement or any prior agreement as well as claims that may arise after the termination of this Arbitration Agreement, in accordance with the notice and opt-out provisions set forth in Sections 13.10 and 13.11). This Arbitration Agreement is governed by the Federal Arbitration Act (“FAA”) in all respects and evidences a transaction involving interstate commerce. You and Wiz expressly agree that the FAA shall exclusively govern the interpretation and enforcement of this Arbitration Agreement. If for whatever reason the rules and procedures of the FAA cannot apply, the state law governing arbitration agreements in the state in which you reside shall apply.
Except as set forth in this Section 13.2, the arbitrator or arbitration body, and not any federal, state or local court or agency, shall have exclusive authority to resolve all disputes arising out of or relating to the interpretation, applicability, enforceability or formation of the Agreement (including these Terms) and this Arbitration Agreement, including, but not limited to any claim that all or any part thereof are void or voidable, whether a claim is subject to arbitration, and any dispute regarding the payment of administrative or arbitrator fees (including the timing of such payments and remedies for nonpayment). The arbitrator or arbitration body shall be empowered to grant whatever relief would be available in a court under law or in equity.
Notwithstanding the parties' decision to resolve all disputes through arbitration, each party retains the right to (i) elect to have any claims resolved in small claims court on an individual basis for disputes and actions within the scope of such court's jurisdiction, regardless of what forum the filing party initial chose; (ii) bring an action in state or federal court to protect its intellectual property rights (“intellectual property rights” in this context means patents, copyrights, moral rights, trademarks, and trade secrets and other confidential or proprietary information, but not privacy or publicity rights); and (iii) seek a declaratory judgment, injunction, or other equitable relief in a court of competent jurisdiction regarding whether a party's claims are time-barred or may be brought in small claims court. Seeking such relief shall not waive a party's right to arbitration under this agreement, and any filed arbitrations related to any action filed pursuant to this paragraph shall automatically be stayed pending the outcome of such action.
You and Wiz agree to submit to the personal jurisdiction of any federal or state court in New York, NY in order to compel arbitration, to stay proceedings pending arbitration, or to confirm, modify, vacate, or enter judgment on the award entered by the arbitrator; and in connection with any such proceeding, further agree to accept service of process by U.S. mail and hereby waive any and all jurisdictional and venue defenses otherwise available.
Except as set forth in Section 13.3 below, if any provision of this Arbitration Agreement is found by an arbitrator or court of competent jurisdiction to be invalid, the parties nevertheless agree that the arbitrator or court should endeavor to give effect to the parties’ intentions as reflected in the provision, and the other provisions thereof remain in full force and effect.
THE PARTIES UNDERSTAND THAT ARBITRATION MEANS THAT AN ARBITRATOR AND NOT A JUDGE OR JURY WILL DECIDE THE CLAIM, AND THAT RIGHTS TO PREHEARING EXCHANGE OF INFORMATION AND APPEALS MAY BE LIMITED IN ARBITRATION. YOU HEREBY ACKNOWLEDGE AND AGREE THAT YOU AND Wiz ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
13.3. Class arbitration and collective relief waiver. YOU AND WIZ ACKNOWLEDGE AND AGREE THAT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, EXCEPT AS SET OUT OTHERWISE IN THIS SECTION 13.3 AND SECTION 13.7 BELOW, ANY ARBITRATION SHALL BE CONDUCTED IN AN INDIVIDUAL CAPACITY ONLY AND NOT AS A CLASS OR OTHER CONSOLIDATED ACTION AND THE ARBITRATOR MAY AWARD RELIEF ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO RESOLVE AN INDIVIDUAL PARTY'S CLAIM, UNLESS WIZ PROVIDES ITS CONSENT TO CONSOLIDATE IN WRITING.
If there is a final judicial determination that either the Class Arbitration Action and Collective Relief Waiver or the provisions in Section 13.7 are not enforceable as to a particular claim or request for relief, then the parties agree that that particular claim or request for relief may proceed in court but shall be severed and stayed pending arbitration of the remaining claims. This provision does not prevent you or Wiz from participating in a class-wide settlement of claims.
13.4. Arbitration rules. The arbitration will be administered by National Arbitration and Mediation (“NAM”) and resolved before a single arbitrator. If NAM is not available to arbitrate, the parties will select an alternative arbitration provider, but in no event shall any arbitration be administered by the American Arbitration Association. Except as modified by this “Dispute Resolution” provision, NAM will administer the arbitration in accordance with the NAM Comprehensive Dispute Resolution Rules and Procedures, Fees For Disputes When One of the Parties is a Consumer and the Mass Filing Dispute Resolution Rules and Procedures in effect at the time any demand for arbitration is filed with NAM, excluding any rules or procedures governing or permitting class or representative actions. The applicable NAM rules and procedures are available at www.namadr.com or by emailing National Arbitration and Mediation's Commercial Dept at commercial@namadr.com.
13.5. Initiating arbitration. Only after the parties have engaged in a good-faith effort to resolve the dispute in accordance with the Informal Dispute Resolution Procedure provision, and only if those efforts fail, then either party may initiate binding arbitration as the sole means to resolve claims using the procedures set forth in the applicable NAM rules. If you are initiating arbitration, a copy of the demand shall also be emailed to legalnotices@wiz.io. If Wiz is initiating arbitration, it will serve a copy of the demand to the email address associated with your Wiz account or the email that Wiz has on file for you. The arbitrator has the right to impose sanctions in accordance with the NAM rules and procedures for any frivolous claims or submissions the arbitrator determines have not been filed in good faith, as well as for a party's failure to comply with the Informal Dispute Resolution Procedure contemplated by this Agreement.
13.6. Arbitration location and procedure. If you are a resident of the United States the arbitration will be conducted in the county where you reside, and if you are not a resident of the United States the arbitration shall be conducted in New York, New York, United States of America, unless you and Wiz otherwise agree or unless the designated arbitrator determines that such venue would be unreasonably burdensome to any party, in which case the arbitrator shall have the discretion to select another venue. If the amount in controversy does not exceed $10,000 and you do not seek injunctive or declaratory relief, then the arbitration will be conducted solely on the basis of documents you and Wiz submit to the arbitrator, unless the arbitrator determines that a hearing is necessary. If the amount in controversy exceeds $10,000 or seeks declaratory or injunctive relief, either party may request (or the arbitrator may determine) to hold a hearing, which shall be via videoconference or telephone conference unless the parties agree otherwise.
Subject to the applicable NAM rules and procedures, the parties agree that the arbitrator will have the discretion to allow the filing of dispositive motions if they are likely to efficiently resolve or narrow issues in dispute. Unless otherwise prohibited by law, all arbitration proceedings will be confidential and closed to the public and any parties other than you and Wiz (and each of the parties’ authorized representatives and agents), and all records relating thereto will be permanently sealed, except as necessary to obtain court confirmation of the arbitration award (provided that the party seeking confirmation shall seek to file such records under seal to the extent permitted by law).
13.7. Batch arbitration. To increase the efficiency of administration and resolution of arbitrations, in the event 100 or more similar arbitration demands (those asserting the same or substantially similar facts or claims, and seeking the same or substantially similar relief) presented by or with the assistance or coordination of the same law firm(s) or organization(s) are submitted to NAM (or another arbitration provider selected in accordance with Section 13.4 if NAM is unavailable) against Wiz within reasonably close proximity (“Mass Filing”), the parties agree (i) to administer the Mass Filing in batches of 100 demands per batch (to the extent there are fewer than 100 arbitration demands left over after the batching described above, a final batch will consist of the remaining demands) with only one batch filed, processed, and adjudicated at a time; (ii) to designate one arbitrator for each batch; (iii) to accept applicable fees, including any related fee reduction determined by NAM (or another arbitration provider selected in accordance with 13.4 if NAM is unavailable) in its discretion; (iv) that no other demands for arbitration that are part of the Mass Filing may be filed, processed, or adjudicated until the prior batch of 100 is filed, processed, and adjudicated; (v) that fees associated with a demand for arbitration included in a Mass Filing, including fees owed by Wiz and the claimants, shall only be due after your demand for arbitration is included in a set of batch proceedings and that batch is properly designated for filing, processing, and adjudication; and (vi) that the staged process of batched proceedings, with each set including 100 demands, shall continue until each demand (including your demand) is adjudicated or otherwise resolved. Arbitrator selection for each batch shall be conducted to the greatest extent possible in accordance with the applicable NAM rules and procedures for such selection, and the arbitrator will determine the location where the proceedings will be conducted. You agree to cooperate in good faith with Wiz and the arbitration provider to implement such a “batch approach” or other similar approach to provide for an efficient resolution of claims, including the payment of combined reduced fees, set by NAM in its discretion, for each batch of claims. The parties further agree to cooperate with each other and the arbitration provider or arbitrator to establish any other processes or procedures that the arbitration provider or arbitrator believe will provide for an efficient resolution of claims. Any disagreement between the parties as to whether this provision applies or as to the process or procedure for batching shall be resolved by a procedural arbitrator appointed by NAM. This “Batch Arbitration” provision shall in no way be interpreted as increasing the number of claims necessary to trigger the applicability of NAM’s Mass Filing Supplemental Dispute Resolution Rules and Procedures or authorizing class arbitration of any kind. Unless Wiz otherwise consents in writing, Wiz does not agree or consent to class arbitration, private attorney general arbitration, or arbitration involving joint or consolidated claims under any circumstances, except as set forth in section 13.3 above and this section 13.7. If your demand for arbitration is included in the Mass Filing, your claims will remain tolled until your demand for arbitration is decided, withdrawn, or is settled.
13.8. Arbitrator's decision. The arbitrator will render an award within the time frame specified in the applicable NAM rules and procedures. The arbitrator's decision will include the essential findings and conclusions upon which the arbitrator based the award. Judgment on the arbitration award may be entered in any court having jurisdiction thereof. The arbitrator will have the authority to award monetary damages on an individual basis and to grant, on an individual basis, any non-monetary remedy or relief available to an individual to the extent available under applicable law, the arbitral forum's rules, and this Arbitration Agreement. The parties agree that the damages and/or other relief must be consistent with section 13.3 above and also must be consistent with the terms of the “Limitation of Liability” section of the Agreement as to the types and the amounts of damages or other relief for which a party may be held liable. No arbitration award or decision will have any preclusive effect as to issues or claims in any dispute with anyone who is not a named party to the arbitration. Attorneys’ fees will be available to the prevailing party in the arbitration only if authorized under applicable substantive law governing the claims in the arbitration.
13.9. Fees. You are responsible for your own attorneys’ fees unless the arbitration rules and/or applicable law provide otherwise. The parties agree that NAM has discretion to reduce the amount or modify the timing of any administrative or arbitration fees due under NAM’s Rules where it deems appropriate (including as specified in Section 13.7), provided that such modification does not increase the costs to you, and you further agree that you waive any objection to such fee modification. The parties also agree that a good-faith challenge by either party to the fees imposed by NAM does not constitute a default, waiver, or breach of this Section 13 while such challenge remains pending before NAM, the arbitrator, and/or a court of competent jurisdiction, and that any and all due dates for those fees shall be tolled during the pendency of such challenge.
13.10. Right to opt-out of the Arbitration Agreement. IF YOU DO NOT WISH TO BE BOUND BY THE “ARBITRATION AGREEMENT” AS SET FORTH IN THIS “DISPUTE RESOLUTION” SECTION 13, THEN: (1) you must notify Wiz in writing within thirty (30) days of the date that you first use the Website or otherwise become subject to this Arbitration Agreement (or any subsequent changes to the provisions of the section titled “Dispute Resolution”); (2) your written notification must be mailed to: Wiz, Inc. Attn: Legal, One Manhattan West, 52nd Floor, New York, NY 10001 or emailed to legalnotices@wiz.io; and (3) your written notification must include (a) your name, (b) your address, (c) the date you purchased the product, if applicable and (d) a clear statement that you wish to opt out of this Arbitration Agreement. Wiz will continue to honor any valid opt outs if you opted out of arbitration in a prior version of the Agreement pursuant to the requirements set forth in that version. If you do not timely opt out of this Arbitration Agreement, such action shall constitute mutual acceptance of the terms of these “Dispute Resolution” provisions by you and Wiz.
13.11. Changes. Wiz will provide thirty (30) days’ notice of any changes to this “Dispute Resolution” section by posting the change on Wiz's website, or providing any other notice in accordance with legal requirements. Any such changes will go into effect 30 days after Wiz provides this notice and apply to all claims not yet filed. If you reject any such changes by opting out of the Arbitration Agreement, you may exercise your right to a trial by jury or judge, as permitted by applicable law, but any prior existing agreement to arbitrate disputes under a prior version of the Arbitration Agreement will not apply to claims not yet filed. If Wiz changes this “Dispute Resolution” section after the date you first accepted this Agreement (or accepted any subsequent changes to this Agreement), you agree that your continued use of the Website 30 days after such change will be deemed acceptance of those changes. If you do not agree to such change, you may opt out by providing notice as described in Section 13.10.
14. Term and Termination. These Terms are effective until terminated by Wiz or you. Wiz, in its sole discretion, has the right to terminate these Terms and/or your access to the Website, or any part thereof, immediately at any time and with or without cause (including, without any limitation, for a breach of these Terms). Wiz shall not be liable to you or any third party for termination of the Website, or any part thereof. If you object to any term or condition of these Terms, or any subsequent modifications thereto, or become dissatisfied with the Website in any way, your only recourse is to immediately discontinue your use of the Website. Upon termination of these Terms, you shall cease all use of the Website. This Section (Section 14) and Sections 6 (Intellectual Property Rights), 9 (Privacy), 10 (Warranty Disclaimers), 11 (Limitation of Liability), 12 (Indemnity), 13 (Dispute Resolution) and Sections 15 (Independent Contractors) to 18 (General) shall survive termination of these Terms.
15. Independent Contractors. You and Wiz are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between you and Wiz. You must not under any circumstances make, or undertake, any warranties, representations, commitments or obligations on behalf of Wiz.
16. Assignment. These Terms, and any rights and licenses granted hereunder, may not be transferred or assigned by you but may be assigned by Wiz without restriction or notification to you. Any prohibited assignment shall be null and void.
17. Governing Law. Wiz reserves the right to discontinue or modify any aspect of the Website at any time. These Terms and the relationship between you and Wiz shall be governed by and construed in accordance with the laws of the State of New York, without regard to its principles of conflict of laws. You agree to submit to the personal and exclusive jurisdiction of the courts located in New York City, New York and waive any jurisdictional, venue, or inconvenient forum objections to such courts, provided that Wiz may seek injunctive relief in any court of competent jurisdiction.
18. General. These Terms shall constitute the entire agreement between you and Wiz concerning the Website. If any provision of these Terms is deemed invalid by a court of competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of these Terms, which shall remain in full force and effect. No waiver of any term of these Terms shall be deemed a further or continuing waiver of such term or any other term, and a party's failure to assert any right or provision under these Terms shall not constitute a waiver of such right or provision. YOU AGREE THAT ANY CAUSE OF ACTION THAT YOU MAY HAVE ARISING OUT OF OR RELATED TO THE WEBSITE MUST COMMENCE WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES. OTHERWISE, SUCH CAUSE OF ACTION IS PERMANENTLY BARRED.
Last updated: February 23, 2023
Effective October 9th 2023 to June 20th 2024
DownloadTable of Contents
Wiz Website Terms of Use
Welcome to https://www.wiz.io/ (together with its subdomains, Content, Marks and services, the “Website”). Please read the following Terms of Use carefully before using this Website so that you are aware of your legal rights and obligations with respect to Wiz Inc. ("Wiz", "we", "our" or "us"). By accessing or using the Website, you expressly acknowledge and agree that you are entering a legal agreement with us and have understood and agree to comply with, and be legally bound by, these Terms of Use, together with our Privacy Policy (collectively the "Terms"). If you do not agree to be bound by these Terms please do not access or use the Website.
PLEASE ALSO READ THESE TERMS OF USE CAREFULLY, AS THEY AFFECT YOUR LEGAL RIGHTS AND OBLIGATIONS. PLEASE NOTE THAT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, THESE TERMS REQUIRE THE USE OF ARBITRATION ON AN INDIVIDUAL BASIS TO RESOLVE DISPUTES, RATHER THAN COURTS OR JURY TRIALS, AND LIMIT THE REMEDIES AVAILABLE IN THE EVENT OF A DISPUTE.
1. Background. The Website is intended to provide you with information related to our products and services and to enable you to contact us via the Website.
2. Modification. We reserve the right, at our discretion, to change these Terms at any time. Such change will be effective ten (10) days following the posting of the revised Terms on the Website, and your continued use of the Website thereafter means that you accept those changes.
3. Ability to Accept Terms. The Website is only intended for individuals aged eighteen (18) years or older. If you are under eighteen (18) years old please do not visit or use the Website.
4. Website Access. For such time as these Terms are in effect, we hereby grant you permission to visit and use the Website, provided that you comply with these Terms and applicable laws.
5. Restrictions. You shall not: (i) copy, distribute or modify any part of the Website without our prior written authorization; (ii) use, modify, create derivative works of, transfer (by sale, resale, license, sublicense, download or otherwise), reproduce, distribute, display or disclose Content (defined below), except as expressly authorized herein; (iii) disrupt servers or networks connected to the Website; (iv) use or launch any automated system (including without limitation, "robots" and "spiders") to access the Website; and/or (v) circumvent, disable or otherwise interfere with security-related features of the Website or features that prevent or restrict use or copying of any Content or that enforce limitations on use of the Website.
6. Intellectual Property Rights.
6.1. Content and Marks. The (i) content on the Website, including without limitation, the text, documents, articles, brochures, descriptions, products, software, graphics, photos, sounds, videos, interactive features, and services (collectively, the "Content"), and (ii) the trademarks, service marks and logos contained therein ("Marks"), are the property of Wiz and/or its licensors and may be protected by applicable copyright or other intellectual property laws and treaties. “Wiz”, the Wiz logo, and other marks are Marks of Wiz or its affiliates. All other trademarks, service marks, and logos used on the Website are the trademarks, service marks, or logos of their respective owners. We reserve all rights not expressly granted in and to the Website and the Content.
6.2. Use of Content. Content on the Website is provided to you for your information and personal use only and may not be used, modified, copied, distributed, transmitted, broadcast, displayed, sold, licensed, de-compiled, or otherwise exploited for any other purposes whatsoever without our prior written consent. If you download or print a copy of the Content you must retain all copyright and other proprietary notices contained therein.
6.3. Spam. You agree not to, and will not, use the communication systems provided by the Website to send unauthorized commercial communications and you shall be solely responsible and liable for any such unauthorized communications.
7. Information Description. We attempt to be as accurate as possible. However, we cannot and do not warrant that the Content available on the Website is accurate, complete, reliable, current, or error-free. We reserve the right to make changes in or to the Content, or any part thereof, in our sole judgment, without the requirement of giving any notice prior to or after making such changes to the Content. Your use of the Content, or any part thereof, is made solely at your own risk and responsibility.
8. Links.
8.1. The Website may contain links, and may enable you to post content, to third party websites that are not owned or controlled by Wiz. We are not affiliated with, have no control over, and assume no responsibility for the content, privacy policies, or practices of, any third party websites. You: (i) are solely responsible and liable for your use of and linking to third party websites and any content that you may send or post to a third party website; and (ii) expressly release Wiz from any and all liability arising from your use of any third party website. Accordingly, we encourage you to read the terms and conditions and privacy policy of each third party website that you may choose to visit.
8.2. Wiz permits you to link to the Website provided that: (i) you link to but do not replicate any page on this Website; (ii) the hyperlink text shall accurately describe the Content as it appears on the Website; (iii) you shall not misrepresent your relationship with Wiz or present any false information about Wiz and shall not imply in any way that we are endorsing any services or products, unless we have given you our express prior consent; (iv) you shall not link from a website ("Third Party Website") which prohibits linking to third parties; (v) such Third Party Website does not contain content that (a) is offensive or controversial (both at our discretion), or (b) infringes any intellectual property, privacy rights, or other rights of any person or entity; and/or (vi) you, and your website, comply with these Terms and applicable law.
9. Privacy. We will use any personal information that we may collect or obtain in connection with the Website in accordance with our privacy policy which is available at: https://www.wiz.io/legal/privacy.
10. Warranty Disclaimers.
10.1. This section applies whether or not the services provided under the Website are for payment. Applicable law may not allow the exclusion of certain warranties, so to that extent certain exclusions set forth herein may not apply.
10.2. THE WEBSITE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, AND WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESS OR IMPLIED. WIZ HEREBY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND THOSE ARISING BY STATUTE OR FROM A COURSE OF DEALING OR USAGE OF TRADE. WIZ DOES NOT GUARANTEE THAT THE WEBSITE WILL BE FREE OF BUGS, SECURITY BREACHES, OR VIRUS ATTACKS. THE WEBSITE MAY OCCASIONALLY BE UNAVAILABLE FOR ROUTINE MAINTENANCE, UPGRADING, OR OTHER REASONS. YOU AGREE THAT WIZ WILL NOT BE HELD RESPONSIBLE FOR ANY CONSEQUENCES TO YOU OR ANY THIRD PARTY THAT MAY RESULT FROM TECHNICAL PROBLEMS OF THE INTERNET, SLOW CONNECTIONS, TRAFFIC CONGESTION OR OVERLOAD OF OUR OR OTHER SERVERS. WE DO NOT WARRANT, ENDORSE OR GUARANTEE ANY CONTENT, PRODUCT, OR SERVICE THAT IS FEATURED OR ADVERTISED ON THE WEBSITE BY A THIRD PARTY.
10.3. EXCEPT AS EXPRESSLY STATED IN OUR PRIVACY POLICY, WIZ DOES NOT MAKE ANY REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE SECURITY OF ANY INFORMATION YOU MAY PROVIDE OR ACTIVITIES YOU ENGAGE IN DURING THE COURSE OF YOUR USE OF THE WEBSITE.
11. Limitation of Liability.
11.1. TO THE FULLEST EXTENT PERMISSIBLE BY LAW, WIZ SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, EXEMPLARY, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES OF ANY KIND, OR FOR ANY LOSS OF DATA, REVENUE, PROFITS OR REPUTATION, ARISING UNDER THESE TERMS OR OUT OF YOUR USE OF, OR INABILITY TO USE, THE WEBSITE, EVEN IF WIZ HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES OR LOSSES. Some jurisdictions do not allow the limitation or exclusion of liability for incidental or consequential damages, so the above limitations may not apply to you.
11.2. IN NO EVENT SHALL THE AGGREGATE LIABILITY OF WIZ FOR ANY DAMAGES ARISING UNDER THESE TERMS OR OUT OF YOUR USE OF, OR INABILITY TO USE THE WEBSITE, EXCEED THE TOTAL AMOUNT OF FEES, IF ANY, PAID BY YOU TO WIZ FOR USING THE WEBSITE DURING THE THREE (3) MONTHS PRIOR TO BRINGING THE CLAIM.
12. Indemnity. You agree to defend, indemnify and hold harmless Wiz and our affiliates, and our respective officers, directors, employees and agents, from and against any and all claims, damages, obligations, losses, liabilities, costs and expenses (including but not limited to attorney's fees) arising from: (i) your use of, or inability to use, the Website; (ii) your interaction with any Website user; or (iii) your violation of these Terms.
13. Dispute Resolution: PLEASE READ THIS “DISPUTE RESOLUTION” SECTION CAREFULLY, AS IT MAY SIGNIFICANTLY AFFECT YOUR LEGAL RIGHTS, INCLUDING YOUR RIGHT TO FILE OR PARTICIPATE IN A LAWSUIT FILED IN COURT.
13.1. Informal dispute resolution procedure. If a dispute arises between you and Wiz, we are committed to working with you to reach a reasonable resolution. For any such dispute, both parties acknowledge and agree that they will first make a good faith effort to resolve it informally before initiating any formal dispute resolution proceeding in arbitration or otherwise. This requires first sending a written description of the dispute to the other party. For any dispute you initiate, you agree to send the written description of the dispute along with the email address associated with your account, if any, to the following email address: legalnotices@wiz.io. For any dispute that Wiz initiates, we will send our written description of the dispute to the email address associated with your Wiz account (if any) or to any email address we have on file for you. The written description must be on an individual basis and provide, at minimum, the following information: your name; a description of the nature or basis of the claim or dispute; and the specific relief sought. If the dispute is not resolved within sixty (60) days after receipt of the written description of the dispute, you and Wiz agree to the further dispute resolution provisions below.
The above process for an informal dispute resolution process is required before you may commence any formal dispute resolution proceeding. The parties agree that any relevant limitations period and filing fees or other deadlines will be tolled while the parties engage in this informal dispute resolution process.
13.2. Mutual arbitration agreement. You and Wiz agree that all claims, disputes, or disagreements that may arise out of the interpretation or performance of these Terms (including its formation, performance, and breach) or payments by or to Wiz, or that in any way relate to the provision or use of the Website, your relationship with Wiz, or any other dispute with Wiz, shall be resolved exclusively through binding arbitration in accordance with this Section 13 (collectively, the “Arbitration Agreement”). This includes claims that arose, were asserted, or involve facts occurring before the existence of this Arbitration Agreement or any prior agreement as well as claims that may arise after the termination of this Arbitration Agreement, in accordance with the notice and opt-out provisions set forth in Sections 13.10 and 13.11). This Arbitration Agreement is governed by the Federal Arbitration Act (“FAA”) in all respects and evidences a transaction involving interstate commerce. You and Wiz expressly agree that the FAA shall exclusively govern the interpretation and enforcement of this Arbitration Agreement. If for whatever reason the rules and procedures of the FAA cannot apply, the state law governing arbitration agreements in the state in which you reside shall apply.
Except as set forth in this Section 13.2, the arbitrator or arbitration body, and not any federal, state or local court or agency, shall have exclusive authority to resolve all disputes arising out of or relating to the interpretation, applicability, enforceability or formation of the Agreement (including these Terms) and this Arbitration Agreement, including, but not limited to any claim that all or any part thereof are void or voidable, whether a claim is subject to arbitration, and any dispute regarding the payment of administrative or arbitrator fees (including the timing of such payments and remedies for nonpayment). The arbitrator or arbitration body shall be empowered to grant whatever relief would be available in a court under law or in equity.
Notwithstanding the parties' decision to resolve all disputes through arbitration, each party retains the right to (i) elect to have any claims resolved in small claims court on an individual basis for disputes and actions within the scope of such court's jurisdiction, regardless of what forum the filing party initial chose; (ii) bring an action in state or federal court to protect its intellectual property rights (“intellectual property rights” in this context means patents, copyrights, moral rights, trademarks, and trade secrets and other confidential or proprietary information, but not privacy or publicity rights); and (iii) seek a declaratory judgment, injunction, or other equitable relief in a court of competent jurisdiction regarding whether a party's claims are time-barred or may be brought in small claims court. Seeking such relief shall not waive a party's right to arbitration under this agreement, and any filed arbitrations related to any action filed pursuant to this paragraph shall automatically be stayed pending the outcome of such action.
You and Wiz agree to submit to the personal jurisdiction of any federal or state court in New York, NY in order to compel arbitration, to stay proceedings pending arbitration, or to confirm, modify, vacate, or enter judgment on the award entered by the arbitrator; and in connection with any such proceeding, further agree to accept service of process by U.S. mail and hereby waive any and all jurisdictional and venue defenses otherwise available.
Except as set forth in Section 13.3 below, if any provision of this Arbitration Agreement is found by an arbitrator or court of competent jurisdiction to be invalid, the parties nevertheless agree that the arbitrator or court should endeavor to give effect to the parties’ intentions as reflected in the provision, and the other provisions thereof remain in full force and effect.
THE PARTIES UNDERSTAND THAT ARBITRATION MEANS THAT AN ARBITRATOR AND NOT A JUDGE OR JURY WILL DECIDE THE CLAIM, AND THAT RIGHTS TO PREHEARING EXCHANGE OF INFORMATION AND APPEALS MAY BE LIMITED IN ARBITRATION. YOU HEREBY ACKNOWLEDGE AND AGREE THAT YOU AND Wiz ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
13.3. Class arbitration and collective relief waiver. YOU AND WIZ ACKNOWLEDGE AND AGREE THAT, TO THE MAXIMUM EXTENT ALLOWED BY LAW, EXCEPT AS SET OUT OTHERWISE IN THIS SECTION 13.3 AND SECTION 13.7 BELOW, ANY ARBITRATION SHALL BE CONDUCTED IN AN INDIVIDUAL CAPACITY ONLY AND NOT AS A CLASS OR OTHER CONSOLIDATED ACTION AND THE ARBITRATOR MAY AWARD RELIEF ONLY IN FAVOR OF THE INDIVIDUAL PARTY SEEKING RELIEF AND ONLY TO THE EXTENT NECESSARY TO RESOLVE AN INDIVIDUAL PARTY'S CLAIM, UNLESS WIZ PROVIDES ITS CONSENT TO CONSOLIDATE IN WRITING.
If there is a final judicial determination that either the Class Arbitration Action and Collective Relief Waiver or the provisions in Section 13.7 are not enforceable as to a particular claim or request for relief, then the parties agree that that particular claim or request for relief may proceed in court but shall be severed and stayed pending arbitration of the remaining claims. This provision does not prevent you or Wiz from participating in a class-wide settlement of claims.
13.4. Arbitration rules. The arbitration will be administered by National Arbitration and Mediation (“NAM”) and resolved before a single arbitrator. If NAM is not available to arbitrate, the parties will select an alternative arbitration provider, but in no event shall any arbitration be administered by the American Arbitration Association. Except as modified by this “Dispute Resolution” provision, NAM will administer the arbitration in accordance with the NAM Comprehensive Dispute Resolution Rules and Procedures, Fees For Disputes When One of the Parties is a Consumer and the Mass Filing Dispute Resolution Rules and Procedures in effect at the time any demand for arbitration is filed with NAM, excluding any rules or procedures governing or permitting class or representative actions. The applicable NAM rules and procedures are available at www.namadr.com or by emailing National Arbitration and Mediation's Commercial Dept at commercial@namadr.com.
13.5. Initiating arbitration. Only after the parties have engaged in a good-faith effort to resolve the dispute in accordance with the Informal Dispute Resolution Procedure provision, and only if those efforts fail, then either party may initiate binding arbitration as the sole means to resolve claims using the procedures set forth in the applicable NAM rules. If you are initiating arbitration, a copy of the demand shall also be emailed to legalnotices@wiz.io. If Wiz is initiating arbitration, it will serve a copy of the demand to the email address associated with your Wiz account or the email that Wiz has on file for you. The arbitrator has the right to impose sanctions in accordance with the NAM rules and procedures for any frivolous claims or submissions the arbitrator determines have not been filed in good faith, as well as for a party's failure to comply with the Informal Dispute Resolution Procedure contemplated by this Agreement.
13.6. Arbitration location and procedure. If you are a resident of the United States the arbitration will be conducted in the county where you reside, and if you are not a resident of the United States the arbitration shall be conducted in New York, New York, United States of America, unless you and Wiz otherwise agree or unless the designated arbitrator determines that such venue would be unreasonably burdensome to any party, in which case the arbitrator shall have the discretion to select another venue. If the amount in controversy does not exceed $10,000 and you do not seek injunctive or declaratory relief, then the arbitration will be conducted solely on the basis of documents you and Wiz submit to the arbitrator, unless the arbitrator determines that a hearing is necessary. If the amount in controversy exceeds $10,000 or seeks declaratory or injunctive relief, either party may request (or the arbitrator may determine) to hold a hearing, which shall be via videoconference or telephone conference unless the parties agree otherwise.
Subject to the applicable NAM rules and procedures, the parties agree that the arbitrator will have the discretion to allow the filing of dispositive motions if they are likely to efficiently resolve or narrow issues in dispute. Unless otherwise prohibited by law, all arbitration proceedings will be confidential and closed to the public and any parties other than you and Wiz (and each of the parties’ authorized representatives and agents), and all records relating thereto will be permanently sealed, except as necessary to obtain court confirmation of the arbitration award (provided that the party seeking confirmation shall seek to file such records under seal to the extent permitted by law).
13.7. Batch arbitration. To increase the efficiency of administration and resolution of arbitrations, in the event 100 or more similar arbitration demands (those asserting the same or substantially similar facts or claims, and seeking the same or substantially similar relief) presented by or with the assistance or coordination of the same law firm(s) or organization(s) are submitted to NAM (or another arbitration provider selected in accordance with Section 13.4 if NAM is unavailable) against Wiz within reasonably close proximity (“Mass Filing”), the parties agree (i) to administer the Mass Filing in batches of 100 demands per batch (to the extent there are fewer than 100 arbitration demands left over after the batching described above, a final batch will consist of the remaining demands) with only one batch filed, processed, and adjudicated at a time; (ii) to designate one arbitrator for each batch; (iii) to accept applicable fees, including any related fee reduction determined by NAM (or another arbitration provider selected in accordance with 13.4 if NAM is unavailable) in its discretion; (iv) that no other demands for arbitration that are part of the Mass Filing may be filed, processed, or adjudicated until the prior batch of 100 is filed, processed, and adjudicated; (v) that fees associated with a demand for arbitration included in a Mass Filing, including fees owed by Wiz and the claimants, shall only be due after your demand for arbitration is included in a set of batch proceedings and that batch is properly designated for filing, processing, and adjudication; and (vi) that the staged process of batched proceedings, with each set including 100 demands, shall continue until each demand (including your demand) is adjudicated or otherwise resolved. Arbitrator selection for each batch shall be conducted to the greatest extent possible in accordance with the applicable NAM rules and procedures for such selection, and the arbitrator will determine the location where the proceedings will be conducted. You agree to cooperate in good faith with Wiz and the arbitration provider to implement such a “batch approach” or other similar approach to provide for an efficient resolution of claims, including the payment of combined reduced fees, set by NAM in its discretion, for each batch of claims. The parties further agree to cooperate with each other and the arbitration provider or arbitrator to establish any other processes or procedures that the arbitration provider or arbitrator believe will provide for an efficient resolution of claims. Any disagreement between the parties as to whether this provision applies or as to the process or procedure for batching shall be resolved by a procedural arbitrator appointed by NAM. This “Batch Arbitration” provision shall in no way be interpreted as increasing the number of claims necessary to trigger the applicability of NAM’s Mass Filing Supplemental Dispute Resolution Rules and Procedures or authorizing class arbitration of any kind. Unless Wiz otherwise consents in writing, Wiz does not agree or consent to class arbitration, private attorney general arbitration, or arbitration involving joint or consolidated claims under any circumstances, except as set forth in section 13.3 above and this section 13.7. If your demand for arbitration is included in the Mass Filing, your claims will remain tolled until your demand for arbitration is decided, withdrawn, or is settled.
13.8. Arbitrator's decision. The arbitrator will render an award within the time frame specified in the applicable NAM rules and procedures. The arbitrator's decision will include the essential findings and conclusions upon which the arbitrator based the award. Judgment on the arbitration award may be entered in any court having jurisdiction thereof. The arbitrator will have the authority to award monetary damages on an individual basis and to grant, on an individual basis, any non-monetary remedy or relief available to an individual to the extent available under applicable law, the arbitral forum's rules, and this Arbitration Agreement. The parties agree that the damages and/or other relief must be consistent with section 13.3 above and also must be consistent with the terms of the “Limitation of Liability” section of the Agreement as to the types and the amounts of damages or other relief for which a party may be held liable. No arbitration award or decision will have any preclusive effect as to issues or claims in any dispute with anyone who is not a named party to the arbitration. Attorneys’ fees will be available to the prevailing party in the arbitration only if authorized under applicable substantive law governing the claims in the arbitration.
13.9. Fees. You are responsible for your own attorneys’ fees unless the arbitration rules and/or applicable law provide otherwise. The parties agree that NAM has discretion to reduce the amount or modify the timing of any administrative or arbitration fees due under NAM’s Rules where it deems appropriate (including as specified in Section 13.7), provided that such modification does not increase the costs to you, and you further agree that you waive any objection to such fee modification. The parties also agree that a good-faith challenge by either party to the fees imposed by NAM does not constitute a default, waiver, or breach of this Section 13 while such challenge remains pending before NAM, the arbitrator, and/or a court of competent jurisdiction, and that any and all due dates for those fees shall be tolled during the pendency of such challenge.
13.10. Right to opt-out of the Arbitration Agreement. IF YOU DO NOT WISH TO BE BOUND BY THE “ARBITRATION AGREEMENT” AS SET FORTH IN THIS “DISPUTE RESOLUTION” SECTION 13, THEN: (1) you must notify Wiz in writing within thirty (30) days of the date that you first use the Website or otherwise become subject to this Arbitration Agreement (or any subsequent changes to the provisions of the section titled “Dispute Resolution”); (2) your written notification must be mailed to: Wiz, Inc. Attn: Legal, One Manhattan West, 57th Floor, New York, NY 10001 or emailed to legalnotices@wiz.io; and (3) your written notification must include (a) your name, (b) your address, (c) the date you purchased the product, if applicable and (d) a clear statement that you wish to opt out of this Arbitration Agreement. Wiz will continue to honor any valid opt outs if you opted out of arbitration in a prior version of the Agreement pursuant to the requirements set forth in that version. If you do not timely opt out of this Arbitration Agreement, such action shall constitute mutual acceptance of the terms of these “Dispute Resolution” provisions by you and Wiz.
13.11. Changes. Wiz will provide thirty (30) days’ notice of any changes to this “Dispute Resolution” section by posting the change on Wiz's website, or providing any other notice in accordance with legal requirements. Any such changes will go into effect 30 days after Wiz provides this notice and apply to all claims not yet filed. If you reject any such changes by opting out of the Arbitration Agreement, you may exercise your right to a trial by jury or judge, as permitted by applicable law, but any prior existing agreement to arbitrate disputes under a prior version of the Arbitration Agreement will not apply to claims not yet filed. If Wiz changes this “Dispute Resolution” section after the date you first accepted this Agreement (or accepted any subsequent changes to this Agreement), you agree that your continued use of the Website 30 days after such change will be deemed acceptance of those changes. If you do not agree to such change, you may opt out by providing notice as described in Section 13.10.
14. Term and Termination. These Terms are effective until terminated by Wiz or you. Wiz, in its sole discretion, has the right to terminate these Terms and/or your access to the Website, or any part thereof, immediately at any time and with or without cause (including, without any limitation, for a breach of these Terms). Wiz shall not be liable to you or any third party for termination of the Website, or any part thereof. If you object to any term or condition of these Terms, or any subsequent modifications thereto, or become dissatisfied with the Website in any way, your only recourse is to immediately discontinue your use of the Website. Upon termination of these Terms, you shall cease all use of the Website. This Section (Section 14) and Sections 6 (Intellectual Property Rights), 9 (Privacy), 10 (Warranty Disclaimers), 11 (Limitation of Liability), 12 (Indemnity), 13 (Dispute Resolution) and Sections 15 (Independent Contractors) to 18 (General) shall survive termination of these Terms.
15. Independent Contractors. You and Wiz are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between you and Wiz. You must not under any circumstances make, or undertake, any warranties, representations, commitments or obligations on behalf of Wiz.
16. Assignment. These Terms, and any rights and licenses granted hereunder, may not be transferred or assigned by you but may be assigned by Wiz without restriction or notification to you. Any prohibited assignment shall be null and void.
17. Governing Law. Wiz reserves the right to discontinue or modify any aspect of the Website at any time. These Terms and the relationship between you and Wiz shall be governed by and construed in accordance with the laws of the State of New York, without regard to its principles of conflict of laws. You agree to submit to the personal and exclusive jurisdiction of the courts located in New York City, New York and waive any jurisdictional, venue, or inconvenient forum objections to such courts, provided that Wiz may seek injunctive relief in any court of competent jurisdiction.
18. General. These Terms shall constitute the entire agreement between you and Wiz concerning the Website. If any provision of these Terms is deemed invalid by a court of competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of these Terms, which shall remain in full force and effect. No waiver of any term of these Terms shall be deemed a further or continuing waiver of such term or any other term, and a party's failure to assert any right or provision under these Terms shall not constitute a waiver of such right or provision. YOU AGREE THAT ANY CAUSE OF ACTION THAT YOU MAY HAVE ARISING OUT OF OR RELATED TO THE WEBSITE MUST COMMENCE WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES. OTHERWISE, SUCH CAUSE OF ACTION IS PERMANENTLY BARRED.
Last updated: February 23, 2023
Privacy Policy
Effective September 10th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 28 August 2025
Table of Contents:
- INTRODUCTION
- WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL DATA
- HOW WE PROTECT AND STORE YOUR PERSONAL DATA
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
- Purpose: Depending on your relationship with Wiz, we collect your data to provide and improve Wiz Offerings, communicate with you regarding your interest in Wiz, conduct marketing initiatives, enable your participation in Wiz initiatives, and comply with our legal obligations.
- Your rights: Based on where you live, you may have rights regarding your data, such as access, correction, and deletion. Wiz provides mechanisms to respond to any requests based on your rights. Nothing in this Privacy Policy is intended to limit your rights.
- Master policy: This Privacy Policy covers Wiz’s processing of Personal Data generally but some of the provisions only apply to individuals in certain countries based on the laws of those countries.
- Updates: We may update this policy, so please check back periodically for the latest version.
Important note: We are the data controller for the processing of the Personal Data of our users, business contacts, job candidates, and website visitors that is covered under this Privacy Policy. In situations where Wiz is providing the services to customers that have entered into an agreement with Wiz, Wiz is the processor/service provider and the customer entity is the controller/business of the information provided to Wiz via the use of the Platform. In such situations, our processing of your Personal Data is subject to an applicable data processing agreement with our customer. |
2. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- We may use Personal Data to detect and prevent fraud or illegal activity, identify and fix errors, conduct audits, and for security purposes.
- We may also use Personal Data to comply with laws, assist authorities, for law enforcement, and to defend legal claims.
- We may anonymize or de-identify your Personal Data so that you can no longer be identified. This anonymized or de-identified information may be used for internal and external purposes, including improving our Wiz Offerings and for research and development.
When you | We collect | To |
Browse the Wiz Website(s) | IP address, pages clicked, events, search and browser information, and device information through analytics tools, cookies, pixels, other similar technologies and log files | Analyze trends and behavior, maintain and improve Wiz Offerings. For more information about our use of cookies, please read our Cookie Policy. |
Register for or use the Platform | Name, business email address, Wiz password, job title, role, company. Automatically collected: data about you and your use of the Platform (e.g., pages visited and clicks, features used, IP address, browser and device information, country, access times, log files) Note: In connection with the use of the Platform, we collect data that we believe is potentially related to unauthorized third parties, such as malware, other suspicious files and potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses. We use this information to analyze and identify potentially suspicious patterns of malicious behavior, to prevent, investigate, or notify of threats, and to improve the services. We may disclose this information to third parties. | Allow you to register and log into the Wiz Platform, to monitor and secure the Platform(e.g., user authentication, logging and debugging, prevent system abuse). Communicate with you and send you information about the Wiz Offerings including product releases. Analyze trends and behavior, maintain, log, debug, improve, and monitor the Wiz Platform. Conduct billing and account management, and perform sanctions checks and other legally required checks. |
Subscribe to service-related updates (e.g., product release notes, status or subprocessor updates etc.) | Business email address, company name | Send you communications for which you have subscribed to. |
Join the Wiz Community | Name, business email address, any identifiers, engagement metrics and any Personal Data that you choose to provide in your interactions | Allow you to participate in and contribute to the Wiz Community and related activities. |
Communicate with us (e.g., feedback) | Name, business email address, job title, role, company, address, telephone number, country, and any other Personal Data you provide (e.g., feedback). This may include meeting recordings (notes, transcriptions, analyses) where applicable. | Conduct account management and support, communicate with you, allow feedback on our Wiz Offerings, and provide general account management support (e.g. ticketing and chat). Note: Where Wiz is processing Personal Data on behalf of our customer, Wiz acts as a data processor and such processing is subject to the data processing agreement in place between Wiz and the customer. |
When you | We collect | To |
Request a demo | Name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may record the demo and/or follow up sessions (which may include Personal Data, notes, transcriptions, analyses) | To communicate with you regarding the Wiz Offerings including to provide you with the demo, collect website analytics, and improve our Wiz Offerings. |
Contact us via our Website(s) including via our chatbot or via our social media profiles or other means | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | Respond to your request and establish a business relationship. |
Download Wiz content (e.g., whitepapers, research etc.) | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | To send you the content you requested. |
Engage in any promotions or receive promotional items | Name, business email address, job title, company, physical address of your choice | Deliver promotional materials (e.g., Wiz-branded merchandise) to you. |
Subscribe to email updates (e.g., newsletters) | Name, business email address, job title, company | Send you communications you have subscribed to. |
Participate in Wiz events / webinars, or interact with Wiz representatives at events or webinars | Name, business email address, job title, company, address, telephone number, country, webinar engagement metrics (e.g., Q&A interactions), and any other Personal Data you provide. The specific form and data types collected in your interactions with Wiz may vary depending on the event / webinar. If you participate in a Wiz competition event, we may reasonably require additional information in accordance with the terms and conditions of the event. | Establish a business relationship, contact you about the Wiz Offerings, enable your participation in the event / webinar and, if applicable, verify your eligibility and issue prizes. If Wiz hosts the event, your information may also be shared with event sponsors or partners. |
Participate in our community research, contest, and education websites (e.g., capture the flag, challenges) | As applicable, name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile link (if you choose to provide), and password | Register you for these initiatives, enable your participation and progress saving, and reward you (if applicable). Please note: some of this information may be publicly disclosed on leaderboards. (See section 'c' if you express interest in marketing activities). |
Participate in or nominate someone to Wiz’s MVP Program | Name, company, job title, area of expertise, biography, photograph, geographic location LinkedIn profile, and any other Personal Data you provide | Enable you and/or your nominee to participate in the Wiz MVP Program (i.e., provide your name, company, job title, and email address to Wiz’s prospective customers or partners as part of the MVP Program), display your or your nominee's details in the Wiz Offerings as a Wiz MVP, and to communicate with you and/or your nominee. |
When you | We collect | To |
Apply to be a Wiz partner or integrate with Wiz | Name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with | Enable the partnership or integration, communicate with you, perform our agreement with you, comply with our legal obligations and record-keeping, and send marketing communications. |
Provide information regarding your services or execute a services agreement with us as a service provider | Name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data you provide | Perform our agreement, communicate with you, and comply with our legal and record-keeping obligations. |
When you | We collect | To |
Sign up to receive training provided by Wiz and take Wiz’s training courses relating to use of the Wiz Platform | Name, business email address, company name, usage data, quiz results, course completion rates | Grant you access to our training platform and deliver training, track your progress, improve our courses and manage our relationship with you. (Note that this data may be shared with your employer or other organization that manages the Wiz tenant at their request.) |
Register under the Wiz Certified program and take the test | Name, business email address, personal email address (if you choose this option), your training and test results, and any relevant medical or health information you disclose for accommodations. Note: Our testing platform will also process credit/debit card numbers, government-issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used only during the exam process and is not retained after the exam results are issued. | Provide you with training, register and verify your identity, administer the exam, issue results, and grant associated badges or certificates. |
When you | We collect | To |
Apply for a job at Wiz | Name, email address, telephone number, CV, personal website, LinkedIn profile, assessment results, background check results, interview notes, whether you are legally authorized to work in the country where the position is posted, your compensation expectations and the agreed compensation if you receive an offer, any request you make for accommodations, and any other Personal Data you disclose or that is captured by authorized recordings. You may also be asked to provide additional information depending on your jurisdiction, including voluntary disclosures such as gender, ethnicity, veteran status, and disability status. | Assess your candidacy for the role(s) you have applied for, review your application, communicate with you, perform background checks, and, if applicable, process any job offers. |
When you | We collect | To |
Visit a Wiz office where CCTV is enabled and/or we keep visitor logs. | Visual recordings collected via closed circuit cameras, name, and email address. | Protect the physical security of the offices, safeguard our offices, people and data, and comply with our contractual obligations (e.g., with customers and insurers). |
3. HOW WE DISCLOSE YOUR PERSONAL DATA
We may disclose your Personal Data to the following categories of third parties: 
When you | We share with |
Are a user of Wiz Offerings |
|
Reach out to Wiz regarding interest in Wiz Offerings or engage in Wiz initiatives |
|
Have been identified as a prospect by Wiz |
|
Are a partner or service provider to Wiz |
|
Participate in any Wiz training or certification initiative |
|
Are a candidate applying for a job at Wiz |
|
Visit any of our offices in person |
|
4. HOW WE PROTECT AND STORE YOUR INFORMATION
5. ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
a) Wiz is a global company and may transfer personal data from its originating jurisdiction as required.
b) Internal transfers: Transfers between Wiz group entities are covered by an internal data processing agreement. This agreement contractually obliges each member to ensure Personal Data receives an adequate and consistent level of protection, regardless of where it is transferred.
c) External transfers:
6. YOUR PRIVACY RIGHTS
a) The following rights may apply to you depending on your jurisdiction of residence:
- You have a right to access Personal Data held about you;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your Personal Data (e.g., for legal claims);
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Also, there may be circumstances where we are entitled to continue processing your Personal Data, particularly if required to meet our legal and regulatory obligations;
- You have a right to request certain details of the basis on which your Personal Data is transferred abroad, as applicable. Please note that data transfer agreements and/or other details may need to be partially redacted for commercial confidentiality reasons;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
7. USE BY CHILDREN
8. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
9. DO NOT TRACK NOTICE
10. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- The purpose for which we use each category of Personal Information (as defined in the CCPA) we collect.
- The categories of third parties to which we (a) disclose such Personal Information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such Personal Information.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
- Right to Access: You have the right to access your Personal Data and, if applicable, any record of data transfer. You also have the right to request disclosure of the purpose of use of your Personal Data.
- Right to Rectify: If the Personal Data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your Personal Data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your Personal Data or the cessation of transfers of your Personal Data to third parties if we no longer need to use your Personal Data, your Personal Data was compromised, or your rights and legitimate interests may be harmed due to our handling of your Personal Data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your Personal Data to third parties if such transfers violate relevant laws.
12. CONTACT US
Effective September 10th 2025 to September 10th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 28 August 2025
Table of Contents:
- INTRODUCTION
- WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL DATA
- HOW WE PROTECT AND STORE YOUR PERSONAL DATA
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
- Purpose: Depending on your relationship with Wiz, we collect your data to provide and improve Wiz Offerings, communicate with you regarding your interest in Wiz, conduct marketing initiatives, enable your participation in Wiz initiatives, and comply with our legal obligations.
- Your rights: Based on where you live, you may have rights regarding your data, such as access, correction, and deletion. Wiz provides mechanisms to respond to any requests based on your rights. Nothing in this Privacy Policy is intended to limit your rights.
- Master policy: This Privacy Policy covers Wiz’s processing of Personal Data generally but some of the provisions only apply to individuals in certain countries based on the laws of those countries.
- Updates: We may update this policy, so please check back periodically for the latest version.
Important note: We are the data controller for the processing of the Personal Data of our users, business contacts, job candidates, and website visitors that is covered under this Privacy Policy. In situations where Wiz is providing the services to customers that have entered into an agreement with Wiz, Wiz is the processor/service provider and the customer entity is the controller/business of the information provided to Wiz via the use of the Platform. In such situations, our processing of your Personal Data is subject to an applicable data processing agreement with our customer. |
2. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- We may use Personal Data to detect and prevent fraud or illegal activity, identify and fix errors, conduct audits, and for security purposes.
- We may also use Personal Data to comply with laws, assist authorities, for law enforcement, and to defend legal claims.
- We may anonymize or de-identify your Personal Data so that you can no longer be identified. This anonymized or de-identified information may be used for internal and external purposes, including improving our Wiz Offerings and for research and development.
When you | We collect | To |
Browse the Wiz Website(s) | IP address, pages clicked, events, search and browser information, and device information through analytics tools, cookies, pixels, other similar technologies and log files | Analyze trends and behavior, maintain and improve Wiz Offerings. For more information about our use of cookies, please read our Cookie Policy. |
Register for or use the Platform | Name, business email address, Wiz password, job title, role, company. Automatically collected: data about you and your use of the Platform (e.g., pages visited and clicks, features used, IP address, browser and device information, country, access times, log files) Note: In connection with the use of the Platform, we collect data that we believe is potentially related to unauthorized third parties, such as malware, other suspicious files and potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses. We use this information to analyze and identify potentially suspicious patterns of malicious behavior, to prevent, investigate, or notify of threats, and to improve the services. We may disclose this information to third parties. | Allow you to register and log into the Wiz Platform, to monitor and secure the Platform(e.g., user authentication, logging and debugging, prevent system abuse). Communicate with you and send you information about the Wiz Offerings including product releases. Analyze trends and behavior, maintain, log, debug, improve, and monitor the Wiz Platform. Conduct billing and account management, and perform sanctions checks and other legally required checks. |
Subscribe to service-related updates (e.g., product release notes, status or subprocessor updates etc.) | Business email address, company name | Send you communications for which you have subscribed to. |
Join the Wiz Community | Name, business email address, any identifiers, engagement metrics and any Personal Data that you choose to provide in your interactions | Allow you to participate in and contribute to the Wiz Community and related activities. |
Communicate with us (e.g., feedback) | Name, business email address, job title, role, company, address, telephone number, country, and any other Personal Data you provide (e.g., feedback). This may include meeting recordings (notes, transcriptions, analyses) where applicable. | Conduct account management and support, communicate with you, allow feedback on our Wiz Offerings, and provide general account management support (e.g. ticketing and chat). Note: Where Wiz is processing Personal Data on behalf of our customer, Wiz acts as a data processor and such processing is subject to the data processing agreement in place between Wiz and the customer. |
When you | We collect | To |
Request a demo | Name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may record the demo and/or follow up sessions (which may include Personal Data, notes, transcriptions, analyses) | To communicate with you regarding the Wiz Offerings including to provide you with the demo, collect website analytics, and improve our Wiz Offerings. |
Contact us via our Website(s) including via our chatbot or via our social media profiles or other means | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | Respond to your request and establish a business relationship. |
Download Wiz content (e.g., whitepapers, research etc.) | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | To send you the content you requested. |
Engage in any promotions or receive promotional items | Name, business email address, job title, company, physical address of your choice | Deliver promotional materials (e.g., Wiz-branded merchandise) to you. |
Subscribe to email updates (e.g., newsletters) | Name, business email address, job title, company | Send you communications you have subscribed to. |
Participate in Wiz events / webinars, or interact with Wiz representatives at events or webinars | Name, business email address, job title, company, address, telephone number, country, webinar engagement metrics (e.g., Q&A interactions), and any other Personal Data you provide. The specific form and data types collected in your interactions with Wiz may vary depending on the event / webinar. If you participate in a Wiz competition event, we may reasonably require additional information in accordance with the terms and conditions of the event. | Establish a business relationship, contact you about the Wiz Offerings, enable your participation in the event / webinar and, if applicable, verify your eligibility and issue prizes. If Wiz hosts the event, your information may also be shared with event sponsors or partners. |
Participate in our community research, contest, and education websites (e.g., capture the flag, challenges) | As applicable, name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile link (if you choose to provide), and password | Register you for these initiatives, enable your participation and progress saving, and reward you (if applicable). Please note: some of this information may be publicly disclosed on leaderboards. (See section 'c' if you express interest in marketing activities). |
Participate in or nominate someone to Wiz’s MVP Program | Name, company, job title, area of expertise, biography, photograph, geographic location LinkedIn profile, and any other Personal Data you provide | Enable you and/or your nominee to participate in the Wiz MVP Program (i.e., provide your name, company, job title, and email address to Wiz’s prospective customers or partners as part of the MVP Program), display your or your nominee's details in the Wiz Offerings as a Wiz MVP, and to communicate with you and/or your nominee. |
When you | We collect | To |
Apply to be a Wiz partner or integrate with Wiz | Name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with | Enable the partnership or integration, communicate with you, perform our agreement with you, comply with our legal obligations and record-keeping, and send marketing communications. |
Provide information regarding your services or execute a services agreement with us as a service provider | Name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data you provide | Perform our agreement, communicate with you, and comply with our legal and record-keeping obligations. |
When you | We collect | To |
Sign up to receive training provided by Wiz and take Wiz’s training courses relating to use of the Wiz Platform | Name, business email address, company name, usage data, quiz results, course completion rates | Grant you access to our training platform and deliver training, track your progress, improve our courses and manage our relationship with you. (Note that this data may be shared with your employer or other organization that manages the Wiz tenant at their request.) |
Register under the Wiz Certified program and take the test | Name, business email address, personal email address (if you choose this option), your training and test results, and any relevant medical or health information you disclose for accommodations. Note: Our testing platform will also process credit/debit card numbers, government-issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used only during the exam process and is not retained after the exam results are issued. | Provide you with training, register and verify your identity, administer the exam, issue results, and grant associated badges or certificates. |
When you | We collect | To |
Apply for a job at Wiz | Name, email address, telephone number, CV, personal website, LinkedIn profile, assessment results, background check results, interview notes, whether you are legally authorized to work in the country where the position is posted, your compensation expectations and the agreed compensation if you receive an offer, any request you make for accommodations, and any other Personal Data you disclose or that is captured by authorized recordings. You may also be asked to provide additional information depending on your jurisdiction, including voluntary disclosures such as gender, ethnicity, veteran status, and disability status. | Assess your candidacy for the role(s) you have applied for, review your application, communicate with you, perform background checks, and, if applicable, process any job offers. |
When you | We collect | To |
Visit a Wiz office where CCTV is enabled | Visual recordings collected via closed circuit cameras | Protect the physical security of the offices, safeguard our offices, people and data, and comply with our contractual obligations (e.g., with customers and insurers). |
3. HOW WE DISCLOSE YOUR PERSONAL DATA
We may disclose your Personal Data to the following categories of third parties: 
When you | We share with |
Are a user of Wiz Offerings |
|
Reach out to Wiz regarding interest in Wiz Offerings or engage in Wiz initiatives |
|
Have been identified as a prospect by Wiz |
|
Are a partner or service provider to Wiz |
|
Participate in any Wiz training or certification initiative |
|
Are a candidate applying for a job at Wiz |
|
Visit any of our offices in person |
|
4. HOW WE PROTECT AND STORE YOUR INFORMATION
5. ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
a) Wiz is a global company and may transfer personal data from its originating jurisdiction as required.
b) Internal transfers: Transfers between Wiz group entities are covered by an internal data processing agreement. This agreement contractually obliges each member to ensure Personal Data receives an adequate and consistent level of protection, regardless of where it is transferred.
c) External transfers:
6. YOUR PRIVACY RIGHTS
a) The following rights may apply to you depending on your jurisdiction of residence:
- You have a right to access Personal Data held about you;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your Personal Data (e.g., for legal claims);
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Also, there may be circumstances where we are entitled to continue processing your Personal Data, particularly if required to meet our legal and regulatory obligations;
- You have a right to request certain details of the basis on which your Personal Data is transferred abroad, as applicable. Please note that data transfer agreements and/or other details may need to be partially redacted for commercial confidentiality reasons;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
7. USE BY CHILDREN
8. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
9. DO NOT TRACK NOTICE
10. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- The purpose for which we use each category of Personal Information (as defined in the CCPA) we collect.
- The categories of third parties to which we (a) disclose such Personal Information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such Personal Information.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
- Right to Access: You have the right to access your Personal Data and, if applicable, any record of data transfer. You also have the right to request disclosure of the purpose of use of your Personal Data.
- Right to Rectify: If the Personal Data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your Personal Data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your Personal Data or the cessation of transfers of your Personal Data to third parties if we no longer need to use your Personal Data, your Personal Data was compromised, or your rights and legitimate interests may be harmed due to our handling of your Personal Data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your Personal Data to third parties if such transfers violate relevant laws.
12. CONTACT US
Effective July 19th 2025 to September 10th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 24 June 2025
Table of Contents:
- INTRODUCTION
- WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL DATA
- HOW WE PROTECT AND STORE YOUR PERSONAL DATA
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
- Purpose: Depending on your relationship with Wiz, we collect your data to provide and improve Wiz Offerings, communicate with you regarding your interest in Wiz, conduct marketing initiatives, enable your participation in Wiz initiatives, and comply with our legal obligations.
- Your rights: Based on where you live, you may have rights regarding your data, such as access, correction, and deletion. Wiz provides mechanisms to respond to any requests based on your rights. Nothing in this Privacy Policy is intended to limit your rights.
- Master policy: This Privacy Policy covers Wiz’s processing of Personal Data generally but some of the provisions only apply to individuals in certain countries based on the laws of those countries.
- Updates: We may update this policy, so please check back periodically for the latest version.
Important note: We are the data controller for the processing of the Personal Data of our users, business contacts, job candidates, and website visitors that is covered under this Privacy Policy. In situations where Wiz is providing the services to customers that have entered into an agreement with Wiz, Wiz is the processor/service provider and the customer entity is the controller/business of the information provided to Wiz via the use of the Platform. In such situations, our processing of your Personal Data is subject to an applicable data processing agreement with our customer. |
2. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- We may use Personal Data to detect and prevent fraud or illegal activity, identify and fix errors, conduct audits, and for security purposes.
- We may also use Personal Data to comply with laws, assist authorities, for law enforcement, and to defend legal claims.
- We may anonymize or de-identify your Personal Data so that you can no longer be identified. This anonymized or de-identified information may be used for internal and external purposes, including improving our Wiz Offerings and for research and development.
When you | We collect | To |
Browse the Wiz Website(s) | IP address, pages clicked, events, search and browser information, and device information through analytics tools, cookies, pixels, other similar technologies and log files | Analyze trends and behavior, maintain and improve Wiz Offerings. For more information about our use of cookies, please read our Cookie Policy. |
Register for or use the Platform | Name, business email address, Wiz password, job title, role, company. Automatically collected: data about you and your use of the Platform (e.g., pages visited and clicks, features used, IP address, browser and device information, country, access times, log files) Note: In connection with the use of the Platform, we collect data that we believe is potentially related to unauthorized third parties, such as malware, other suspicious files and potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses. We use this information to analyze and identify potentially suspicious patterns of malicious behavior, to prevent, investigate, or notify of threats, and to improve the services. We may disclose this information to third parties. | Allow you to register and log into the Wiz Platform, to monitor and secure the Platform(e.g., user authentication, logging and debugging, prevent system abuse). Communicate with you and send you information about the Wiz Offerings including product releases. Analyze trends and behavior, maintain, log, debug, improve, and monitor the Wiz Platform. Conduct billing and account management, and perform sanctions checks and other legally required checks. |
Subscribe to service-related updates (e.g., product release notes, status or subprocessor updates etc.) | Business email address, company name | Send you communications for which you have subscribed to. |
Join the Wiz Community | Name, business email address, any identifiers, engagement metrics and any Personal Data that you choose to provide in your interactions | Allow you to participate in and contribute to the Wiz Community and related activities. |
Communicate with us (e.g., feedback) | Name, business email address, job title, role, company, address, telephone number, country, and any other Personal Data you provide (e.g., feedback). This may include meeting recordings (notes, transcriptions, analyses) where applicable. | Conduct account management and support, communicate with you, allow feedback on our Wiz Offerings, and provide general account management support (e.g. ticketing and chat). Note: Where Wiz is processing Personal Data on behalf of our customer, Wiz acts as a data processor and such processing is subject to the data processing agreement in place between Wiz and the customer. |
When you | We collect | To |
Request a demo | Name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may record the demo and/or follow up sessions (which may include Personal Data, notes, transcriptions, analyses) | To communicate with you regarding the Wiz Offerings including to provide you with the demo, collect website analytics, and improve our Wiz Offerings. |
Contact us via our Website(s) including via our chatbot or via our social media profiles or other means | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | Respond to your request and establish a business relationship. |
Download Wiz content (e.g., whitepapers, research etc.) | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | To send you the content you requested. |
Engage in any promotions or receive promotional items | Name, business email address, job title, company, physical address of your choice | Deliver promotional materials (e.g., Wiz-branded merchandise) to you. |
Subscribe to email updates (e.g., newsletters) | Name, business email address, job title, company | Send you communications you have subscribed to. |
Participate in Wiz events / webinars, or interact with Wiz representatives at events or webinars | Name, business email address, job title, company, address, telephone number, country, webinar engagement metrics (e.g., Q&A interactions), and any other Personal Data you provide | Establish a business relationship, contact you about the Wiz Offerings. If Wiz hosts the event, your information may also be shared with event sponsors. |
Participate in our community research, contest, and education websites (e.g., capture the flag, challenges) | As applicable, name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile link (if you choose to provide), and password | Register you for these initiatives, enable your participation and progress saving, and reward you (if applicable). Please note: some of this information may be publicly disclosed on leaderboards. (See section 'c' if you express interest in marketing activities). |
Participate in Wiz’s MVP Program | Name, company, job title, area of expertise, biography, photograph, geographic location and any other Personal Data you provide | Enable you to participate in the Wiz MVP Program (i.e., provide your name, company, job title, and email address to Wiz’s prospective customers or partners as part of the MVP Program), display your details in the Wiz Offerings as a Wiz MVP, and to communicate with you. |
When you | We collect | To |
Apply to be a Wiz partner or integrate with Wiz | Name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with | Enable the partnership or integration, communicate with you, perform our agreement with you, comply with our legal obligations and record-keeping, and send marketing communications. |
Provide information regarding your services or execute a services agreement with us as a service provider | Name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data you provide | Perform our agreement, communicate with you, and comply with our legal and record-keeping obligations. |
When you | We collect | To |
Sign up to receive training provided by Wiz and take Wiz’s training courses relating to use of the Wiz Platform | Name, business email address, company name, usage data, quiz results, course completion rates | Grant you access to our training platform and deliver training, track your progress, improve our courses and manage our relationship with you. (Note that this data may be shared with your employer or other organization that manages the Wiz tenant at their request.) |
Register under the Wiz Certified program and take the test | Name, business email address, personal email address (if you choose this option), your training and test results, and any relevant medical or health information you disclose for accommodations. Note: Our testing platform will also process credit/debit card numbers, government-issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used only during the exam process and is not retained after the exam results are issued. | Provide you with training, register and verify your identity, administer the exam, issue results, and grant associated badges or certificates. |
When you | We collect | To |
Apply for a job at Wiz | Name, email address, telephone number, CV, personal website, LinkedIn profile, assessment results, background check results, interview notes, whether you are legally authorized to work in the country where the position is posted, your compensation expectations and the agreed compensation if you receive an offer, any request you make for accommodations, and any other Personal Data you disclose or that is captured by authorized recordings. You may also be asked to provide additional information depending on your jurisdiction, including voluntary disclosures such as gender, ethnicity, veteran status, and disability status. | Assess your candidacy for the role(s) you have applied for, review your application, communicate with you, perform background checks, and, if applicable, process any job offers. |
When you | We collect | To |
Visit a Wiz office where CCTV is enabled | Visual recordings collected via closed circuit cameras | Protect the physical security of the offices, safeguard our offices, people and data, and comply with our contractual obligations (e.g., with customers and insurers). |
3. HOW WE DISCLOSE YOUR PERSONAL DATA
We may disclose your Personal Data to the following categories of third parties: 
When you | We share with |
Are a user of Wiz Offerings |
|
Reach out to Wiz regarding interest in Wiz Offerings or engage in Wiz initiatives |
|
Have been identified as a prospect by Wiz |
|
Are a partner or service provider to Wiz |
|
Participate in any Wiz training or certification initiative |
|
Are a candidate applying for a job at Wiz |
|
Visit any of our offices in person |
|
4. HOW WE PROTECT AND STORE YOUR INFORMATION
5. ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
a) Wiz is a global company and may transfer personal data from its originating jurisdiction as required.
b) Internal transfers: Transfers between Wiz group entities are covered by an internal data processing agreement. This agreement contractually obliges each member to ensure Personal Data receives an adequate and consistent level of protection, regardless of where it is transferred.
c) External transfers:
6. YOUR PRIVACY RIGHTS
a) The following rights may apply to you depending on your jurisdiction of residence:
- You have a right to access Personal Data held about you;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your Personal Data (e.g., for legal claims);
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Also, there may be circumstances where we are entitled to continue processing your Personal Data, particularly if required to meet our legal and regulatory obligations;
- You have a right to request certain details of the basis on which your Personal Data is transferred abroad, as applicable. Please note that data transfer agreements and/or other details may need to be partially redacted for commercial confidentiality reasons;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
7. USE BY CHILDREN
8. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
9. DO NOT TRACK NOTICE
10. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- The purpose for which we use each category of Personal Information (as defined in the CCPA) we collect.
- The categories of third parties to which we (a) disclose such Personal Information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such Personal Information.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
- Right to Access: You have the right to access your Personal Data and, if applicable, any record of data transfer. You also have the right to request disclosure of the purpose of use of your Personal Data.
- Right to Rectify: If the Personal Data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your Personal Data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your Personal Data or the cessation of transfers of your Personal Data to third parties if we no longer need to use your Personal Data, your Personal Data was compromised, or your rights and legitimate interests may be harmed due to our handling of your Personal Data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your Personal Data to third parties if such transfers violate relevant laws.
12. CONTACT US
Effective July 9th 2025 to July 19th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 24 June 2025
Table of Contents:
- INTRODUCTION
- WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL DATA
- HOW WE PROTECT AND STORE YOUR PERSONAL DATA
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
- Purpose: Depending on your relationship with Wiz, we collect your data to provide and improve Wiz Offerings, communicate with you regarding your interest in Wiz, conduct marketing initiatives, enable your participation in Wiz initiatives, and comply with our legal obligations.
- Your rights: Based on where you live, you may have rights regarding your data, such as access, correction, and deletion. Wiz provides mechanisms to respond to any requests based on your rights. Nothing in this Privacy Policy is intended to limit your rights.
- Master policy: This Privacy Policy covers Wiz’s processing of Personal Data generally but some of the provisions only apply to individuals in certain countries based on the laws of those countries.
- Updates: We may update this policy, so please check back periodically for the latest version.
Important note: We are the data controller for the processing of the Personal Data of our users, business contacts, job candidates, and website visitors that is covered under this Privacy Policy. In situations where Wiz is providing the services to customers that have entered into an agreement with Wiz, Wiz is the processor/service provider and the customer entity is the controller/business of the information provided to Wiz via the use of the Platform. In such situations, our processing of your Personal Data is subject to an applicable data processing agreement with our customer. |
2. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT
- We may use Personal Data to detect and prevent fraud or illegal activity, identify and fix errors, conduct audits, and for security purposes.
- We may also use Personal Data to comply with laws, assist authorities, for law enforcement, and to defend legal claims.
- We may anonymize or de-identify your Personal Data so that you can no longer be identified. This anonymized or de-identified information may be used for internal and external purposes, including improving our Wiz Offerings and for research and development.
When you | We collect | To |
Browse the Wiz Website(s) | IP address, pages clicked, events, search and browser information, and device information through analytics tools, cookies, pixels, other similar technologies and log files | Analyze trends and behavior, maintain and improve Wiz Offerings. For more information about our use of cookies, please read our Cookie Policy. |
Register for or use the Platform | Name, business email address, Wiz password, job title, role, company. Automatically collected: data about you and your use of the Platform (e.g., pages visited and clicks, features used, IP address, browser and device information, country, access times, log files) Note: In connection with the use of the Platform, we collect data that we believe is potentially related to unauthorized third parties, such as malware, other suspicious files and potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses. We use this information to analyze and identify potentially suspicious patterns of malicious behavior, to prevent, investigate, or notify of threats, and to improve the services. We may disclose this information to third parties. | Allow you to register and log into the Wiz Platform, to monitor and secure the Platform(e.g., user authentication, logging and debugging, prevent system abuse). Communicate with you and send you information about the Wiz Offerings including product releases. Analyze trends and behavior, maintain, log, debug, improve, and monitor the Wiz Platform. Conduct billing and account management, and perform sanctions checks and other legally required checks. |
Subscribe to service-related updates (e.g., product release notes, status or subprocessor updates etc.) | Business email address, company name | Send you communications for which you have subscribed to. |
Join the Wiz Community | Name, business email address, any identifiers, engagement metrics and any Personal Data that you choose to provide in your interactions | Allow you to participate in and contribute to the Wiz Community and related activities. |
Communicate with us (e.g., feedback) | Name, business email address, job title, role, company, address, telephone number, country, and any other Personal Data you provide (e.g., feedback). This may include meeting recordings (notes, transcriptions, analyses) where applicable. | Conduct account management and support, communicate with you, allow feedback on our Wiz Offerings, and provide general account management support (e.g. ticketing and chat). Note: Where Wiz is processing Personal Data on behalf of our customer, Wiz acts as a data processor and such processing is subject to the data processing agreement in place between Wiz and the customer. |
When you | We collect | To |
Request a demo | Name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may record the demo and/or follow up sessions (which may include Personal Data, notes, transcriptions, analyses) | To communicate with you regarding the Wiz Offerings including to provide you with the demo, collect website analytics, and improve our Wiz Offerings. |
Contact us via our Website(s) including via our chatbot or via our social media profiles or other means | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | Respond to your request and establish a business relationship. |
Download Wiz content (e.g., whitepapers, research etc.) | Name, business email address, company, job title, work telephone number, country, message and any other Personal Data you provide | To send you the content you requested. |
Engage in any promotions or receive promotional items | Name, business email address, job title, company, physical address of your choice | Deliver promotional materials (e.g., Wiz-branded merchandise) to you. |
Subscribe to email updates (e.g., newsletters) | Name, business email address, job title, company | Send you communications you have subscribed to. |
Participate in Wiz events / webinars, or interact with Wiz representatives at events or webinars | Name, business email address, job title, company, address, telephone number, country, webinar engagement metrics (e.g., Q&A interactions), and any other Personal Data you provide | Establish a business relationship, contact you about the Wiz Offerings. If Wiz hosts the event, your information may also be shared with event sponsors. |
Participate in our community research, contest, and education websites (e.g., capture the flag, challenges) | As applicable, name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile link (if you choose to provide), and password | Register you for these initiatives, enable your participation and progress saving, and reward you (if applicable). Please note: some of this information may be publicly disclosed on leaderboards. (See section 'c' if you express interest in marketing activities). |
Participate in Wiz’s MVP Program | Name, company, job title, area of expertise, biography, photograph, geographic location and any other Personal Data you provide | Enable you to participate in the Wiz MVP Program (i.e., provide your name, company, job title, and email address to Wiz’s prospective customers or partners as part of the MVP Program), display your details in the Wiz Offerings as a Wiz MVP, and to communicate with you. |
When you | We collect | To |
Apply to be a Wiz partner or integrate with Wiz | Name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with | Enable the partnership or integration, communicate with you, perform our agreement with you, comply with our legal obligations and record-keeping, and send marketing communications. |
Provide information regarding your services or execute a services agreement with us as a service provider | Name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data you provide | Perform our agreement, communicate with you, and comply with our legal and record-keeping obligations. |
When you | We collect | To |
Sign up to receive training provided by Wiz and take Wiz’s training courses relating to use of the Wiz Platform | Name, business email address, company name, usage data, quiz results, course completion rates | Grant you access to our training platform and deliver training, track your progress, improve our courses and manage our relationship with you. (Note that this data may be shared with your employer or other organization that manages the Wiz tenant at their request.) |
Register under the Wiz Certified program and take the test | Name, business email address, personal email address (if you choose this option), your training and test results, and any relevant medical or health information you disclose for accommodations. Note: Our testing platform will also process credit/debit card numbers, government-issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used only during the exam process and is not retained after the exam results are issued. | Provide you with training, register and verify your identity, administer the exam, issue results, and grant associated badges or certificates. |
When you | We collect | To |
Apply for a job at Wiz | Name, email address, telephone number, CV, personal website, LinkedIn profile, assessment results, background check results, interview notes, whether you are legally authorized to work in the country where the position is posted, your compensation expectations and the agreed compensation if you receive an offer, any request you make for accommodations, and any other Personal Data you disclose or that is captured by authorized recordings. You may also be asked to provide additional information depending on your jurisdiction, including voluntary disclosures such as gender, ethnicity, veteran status, and disability status. | Assess your candidacy for the role(s) you have applied for, review your application, communicate with you, perform background checks, and, if applicable, process any job offers. |
When you | We collect | To |
Visit a Wiz office where CCTV is enabled | Visual recordings collected via closed circuit cameras | Protect the physical security of the offices, safeguard our offices, people and data, and comply with our contractual obligations (e.g., with customers and insurers). |
3. HOW WE DISCLOSE YOUR PERSONAL DATA
We may disclose your Personal Data to the following categories of third parties: 
When you | We share with |
Are a user of Wiz Offerings |
|
Reach out to Wiz regarding interest in Wiz Offerings or engage in Wiz initiatives |
|
Have been identified as a prospect by Wiz |
|
Are a partner or service provider to Wiz |
|
Participate in any Wiz training or certification initiative |
|
Are a candidate applying for a job at Wiz |
|
Visit any of our offices in person |
|
4. HOW WE PROTECT AND STORE YOUR INFORMATION
5. ADDITIONAL INFORMATION REGARDING TRANSFERS OF PERSONAL DATA
a) Wiz is a global company and may transfer personal data from its originating jurisdiction as required.
b) Internal transfers: Transfers between Wiz group entities are covered by an internal data processing agreement. This agreement contractually obliges each member to ensure Personal Data receives an adequate and consistent level of protection, regardless of where it is transferred.
c) External transfers:
6. YOUR PRIVACY RIGHTS
a) The following rights may apply to you depending on your jurisdiction of residence:
- You have a right to access Personal Data held about you;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g., from our records). Please note that there may be circumstances in which we are required to retain your Personal Data (e.g., for legal claims);
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Also, there may be circumstances where we are entitled to continue processing your Personal Data, particularly if required to meet our legal and regulatory obligations;
- You have a right to request certain details of the basis on which your Personal Data is transferred abroad, as applicable. Please note that data transfer agreements and/or other details may need to be partially redacted for commercial confidentiality reasons;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
7. USE BY CHILDREN
8. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
9. DO NOT TRACK NOTICE
10. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- The purpose for which we use each category of Personal Information (as defined in the CCPA) we collect.
- The categories of third parties to which we (a) disclose such Personal Information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such Personal Information.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
- Right to Access: You have the right to access your Personal Data and, if applicable, any record of data transfer. You also have the right to request disclosure of the purpose of use of your Personal Data.
- Right to Rectify: If the Personal Data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your Personal Data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your Personal Data or the cessation of transfers of your Personal Data to third parties if we no longer need to use your Personal Data, your Personal Data was compromised, or your rights and legitimate interests may be harmed due to our handling of your Personal Data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your Personal Data to third parties if such transfers violate relevant laws.
12. CONTACT US
Effective March 25th 2025 to July 9th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 24 March 2025
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the Services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, pixels, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions (which could include note-taking, transcriptions and analyzes thereof, as applicable) for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications.
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, webinar engagement metrics (such as Q&A interactions), and any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications. Where Wiz is the host of the event, your information may also be shared with event sponsors, as applicable.
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We and/or our event sponsors cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications.
h. When we use the Personal Data of our customers/end-users and prospects (e.g. when we communicate with customers or prospects, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with, e.g., any feedback you provide to the extent it includes Personal Data. This may include meeting recordings (which could include note-taking, transcriptions and analyzes thereof), where applicable. If you are a member of any of the Wiz Communities, it includes any identifiers, engagement metrics and any Personal Data that you choose to provide in your interactions with any of the communities.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to your use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: In connection with your use of the Services we may collect data that we believe may be potentially related to unauthorized third parties, such as malware, and other suspicious files or potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses.
- For what purposes: We use this information to analyze and identify potentially suspicious patterns of malicious behavior to prevent, investigate, or notify of threats, and to improve the Services. We may disclose this information to third parties.
- Legal basis:
- Legitimate interest (to provide and improve the Services and for threat intelligence)
- Consequences of not providing the Personal Data: Certain Services features may not be available or may not be improved.
j. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
k. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
l. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
m. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
n. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.) or promotions
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password. If you participate in any promotions and giveaways, also your home address or an address of your choice.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your Personal Data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction). If you participate in any promotions or giveaways, we will use your information to deliver the promotional materials (for example, Wiz-branded merchandise) to you.
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
- Personal Data we collect or receive for these purposes: Visual images collected via closed circuit cameras.
- For what purposes: For the purpose of protecting the physical security of the offices, to safeguard our offices, people and data, and to comply with our contractual obligations (e.g., with customers and insurers).
- Legal basis: Legitimate interest (to protect and secure our offices)
- Consequences of not providing the Personal Data: We cannot protect and secure our offices and comply with our contractual obligations.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
- Personal Data we collect or receive for these purposes*: Full name, business email address, personal email address (if you choose to become certified through your personal email address), your training and test results, and any relevant medical or health information you choose to disclose to us if you request any accommodations.
- *Please note that our testing platform will also process credit or debit card numbers, government issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used during the exam process only and is not retained after the exam results have been issued.
- For what purposes: We will use your Personal Data to provide you with training, register you and verify your identity, provide the exam, issue the exam results, and grant any badges or certificates associated with the program.
- Legal basis:
- Consent (if required by applicable law)
- Legitimate interests (to provide you with training, issuing your certificate badges or credentials and responding to your inquiries)
- Consequences of not providing the Personal Data: You cannot participate in Wiz’s certification or training programs.
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Online testing and issuing a digital badge
- Other service providers to the extent required to fulfill the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR and where applicable, the Act on the Protection of Personal Information ("APPI") protected Personal Data outside of the EEA, UK or Japan (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR or the APPI e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR, UK GDPR and APPI.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area, the United Kingdom or Japan, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us through our Privacy Center. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfill your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. PRIVACY INFORMATION FOR JAPAN RESIDENTS
- Right to Access: You have the right to access your personal data and, if applicable, any record of data transfer. You also have the right to request disclosure of purpose of use of your personal data.
- Right to Rectify: If the personal data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your personal data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your personal data or the cessation of transfers of your personal data to third parties if we no longer need to use your personal data, your personal data was compromised, or your rights and legitimate interests may be harmed due to our handling of your personal data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your personal data to third parties if such transfers violate relevant laws.
13. CONTACT US
If you have any questions regarding this notice we encourage you to contact us at privacy@wiz.io. If you wish to exercise your rights, you can visit our Privacy Center.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective January 16th 2025 to March 25th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 27 December 2024
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, pixels, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy. Wiz Community participants may find the list of cookies used here.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions (which could include note-taking, transcriptions and analyzes thereof, as applicable) for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications. Where Wiz is the host of the event, your information may also be shared with event sponsors, as applicable.
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We and/or our event sponsors cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
h. When we use the Personal Data of our customers/end-users and prospects (e.g. when we communicate with customers or prospects, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. This may include meeting recordings (which could include note-taking, transcriptions and analyzes thereof), where applicable. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities (including a username of your choice) may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to your use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: In connection with your use of the Services we may collect data that we believe may be potentially related to unauthorized third parties, such as malware, and other suspicious files or potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses.
- For what purposes: We use this information to analyze and identify potentially suspicious patterns of malicious behavior to prevent, investigate, or notify of threats, and to improve the Services. We may disclose this information to third parties.
- Legal basis:
- Legitimate interest (to provide and improve the Services and for threat intelligence)
- Consequences of not providing the Personal Data: Certain Services features may not be available or may not be improved.
j. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
k. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
l. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
m. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
n. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.)
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your Personal Data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction).
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
- Personal Data we collect or receive for these purposes: Visual images collected via closed circuit cameras.
- For what purposes: For the purpose of protecting the physical security of the offices, to safeguard our offices, people and data, and to comply with our contractual obligations (e.g., with customers and insurers).
- Legal basis: Legitimate interest (to protect and secure our offices)
- Consequences of not providing the Personal Data: We cannot protect and secure our offices and comply with our contractual obligations.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
- Personal Data we collect or receive for these purposes*: Full name, business email address, personal email address (if you choose to become certified through your personal email address), your training and test results, and any relevant medical or health information you choose to disclose to us if you request any accommodations.
- *Please note that our testing platform will also process credit or debit card numbers, government issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used during the exam process only and is not retained after the exam results have been issued.
- For what purposes: We will use your Personal Data to provide you with training, register you and verify your identity, provide the exam, issue the exam results, and grant any badges or certificates associated with the program.
- Legal basis:
- Consent (if required by applicable law)
- Legitimate interests (to provide you with training, issuing your certificate badges or credentials and responding to your inquiries)
- Consequences of not providing the Personal Data: You cannot participate in Wiz’s certification or training programs.
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Online testing and issuing a digital badge
- Other service providers to the extent required to fulfill the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR and where applicable, the Act on the Protection of Personal Information ("APPI") protected Personal Data outside of the EEA, UK or Japan (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR or the APPI e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR, UK GDPR and APPI.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area, the United Kingdom or Japan, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us through our Privacy Center. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfill your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. PRIVACY INFORMATION FOR JAPAN RESIDENTS
- Right to Access: You have the right to access your personal data and, if applicable, any record of data transfer. You also have the right to request disclosure of purpose of use of your personal data.
- Right to Rectify: If the personal data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your personal data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your personal data or the cessation of transfers of your personal data to third parties if we no longer need to use your personal data, your personal data was compromised, or your rights and legitimate interests may be harmed due to our handling of your personal data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your personal data to third parties if such transfers violate relevant laws.
13. CONTACT US
If you have any questions regarding this notice we encourage you to contact us at privacy@wiz.io. If you wish to exercise your rights, you can visit our Privacy Center.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective January 15th 2025 to January 16th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 27 December 2024
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- PRIVACY INFORMATION FOR JAPAN RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, pixels, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy. Wiz Community participants may find the list of cookies used here.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions (which could include note-taking, transcriptions and analyzes thereof, as applicable) for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications. Where Wiz is the host of the event, your information may also be shared with event sponsors, as applicable.
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We and/or our event sponsors cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
h. When we use the Personal Data of our customers/end-users and prospects (e.g. when we communicate with customers or prospects, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. This may include meeting recordings (which could include note-taking, transcriptions and analyzes thereof), where applicable. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities (including a username of your choice) may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: In connection with your use of the Services we may collect data that we believe may be potentially related to unauthorized third parties, such as malware, and other suspicious files or potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses.
- For what purposes: We use this information to analyze and identify potentially suspicious patterns of malicious behavior to prevent, investigate, or notify of threats, and to improve the Services. We may disclose this information to third parties.
- Legal basis:
- Legitimate interest (to provide and improve the Services and for threat intelligence)
- Consequences of not providing the Personal Data: Certain Services features may not be available or may not be improved.
j. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
k. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
l. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
m. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
n. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.)
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your Personal Data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction).
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
- Personal Data we collect or receive for these purposes: Visual images collected via closed circuit cameras.
- For what purposes: For the purpose of protecting the physical security of the offices, to safeguard our offices, people and data, and to comply with our contractual obligations (e.g., with customers and insurers).
- Legal basis: Legitimate interest (to protect and secure our offices)
- Consequences of not providing the Personal Data: We cannot protect and secure our offices and comply with our contractual obligations.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
- Personal Data we collect or receive for these purposes*: Full name, business email address, personal email address (if you choose to become certified through your personal email address), your training and test results, and any relevant medical or health information you choose to disclose to us if you request any accommodations.
- *Please note that our testing platform will also process credit or debit card numbers, government issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used during the exam process only and is not retained after the exam results have been issued.
- For what purposes: We will use your Personal Data to provide you with training, register you and verify your identity, provide the exam, issue the exam results, and grant any badges or certificates associated with the program.
- Legal basis:
- Consent (if required by applicable law)
- Legitimate interests (to provide you with training, issuing your certificate badges or credentials and responding to your inquiries)
- Consequences of not providing the Personal Data: You cannot participate in Wiz’s certification or training programs.
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Online testing and issuing a digital badge
- Other service providers to the extent required to fulfill the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR and where applicable, the Act on the Protection of Personal Information ("APPI") protected Personal Data outside of the EEA, UK or Japan (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR or the APPI e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR, UK GDPR and APPI.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area, the United Kingdom or Japan, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us through our Privacy Center. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfill your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. PRIVACY INFORMATION FOR JAPAN RESIDENTS
- Right to Access: You have the right to access your personal data and, if applicable, any record of data transfer. You also have the right to request disclosure of purpose of use of your personal data.
- Right to Rectify: If the personal data held by us is incorrect or incomplete, you are entitled to request correction, addition, or deletion of the inaccurate or incomplete information.
- Right to Erasure and Restriction of Processing: You may request the deletion or restriction of processing of your personal data in cases where the data has been used beyond the necessary scope for achieving the original purpose of collection, was collected or processed unlawfully, or if the utilization of data could lead to unlawful acts. You may also request the restriction of processing of your personal data or the cessation of transfers of your personal data to third parties if we no longer need to use your personal data, your personal data was compromised, or your rights and legitimate interests may be harmed due to our handling of your personal data.
- Right to Restrict Third-Party Transfers: You can request cessation of transfers of your personal data to third parties if such transfers violate relevant laws.
13. CONTACT US
If you have any questions regarding this notice we encourage you to contact us at privacy@wiz.io. If you wish to exercise your rights, you can visit our Privacy Center.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective October 23rd 2024 to January 15th 2025
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 23 October 2024
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, pixels, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
h. When we use the Personal Data of our customers/end-users and prospects (e.g. when we communicate with customers or prospects, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. This may include meeting recordings where applicable. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities (including a username of your choice) may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: In connection with your use of the Services we may collect data that we believe may be potentially related to unauthorized third parties, such as malware, and other suspicious files or potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses.
- For what purposes: We use this information to analyze and identify potentially suspicious patterns of malicious behavior to prevent, investigate, or notify of threats, and to improve the Services. We may disclose this information to third parties.
- Legal basis:
- Legitimate interest (to provide and improve the Services and for threat intelligence)
- Consequences of not providing the Personal Data: Certain Services features may not be available or may not be improved.
j. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
k. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
l. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
m. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
n. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.)
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your Personal Data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction).
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
- Personal Data we collect or receive for these purposes: Visual images collected via closed circuit cameras.
- For what purposes: For the purpose of protecting the physical security of the offices, to safeguard our offices, people and data, and to comply with our contractual obligations (e.g., with customers and insurers).
- Legal basis: Legitimate interest (to protect and secure our offices)
- Consequences of not providing the Personal Data: We cannot protect and secure our offices and comply with our contractual obligations.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
- Personal Data we collect or receive for these purposes*: Full name, business email address, personal email address (if you choose to become certified through your personal email address), your training and test results, and any relevant medical or health information you choose to disclose to us if you request any accommodations.
- *Please note that our testing platform will also process credit or debit card numbers, government issued photo ID, a current photo of you, audio and video recordings of you taking the exam, and keystroke data. This data is used during the exam process only and is not retained after the exam results have been issued.
- For what purposes: We will use your Personal Data to provide you with training, register you and verify your identity, provide the exam, issue the exam results, and grant any badges or certificates associated with the program.
- Legal basis:
- Consent (if required by applicable law)
- Legitimate interests (to provide you with training, issuing your certificate badges or credentials and responding to your inquiries)
- Consequences of not providing the Personal Data: You cannot participate in Wiz’s certification or training programs.
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Online testing and issuing a digital badge
- Other service providers to the extent required to fulfill the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR protected Personal Data outside of the EEA or UK (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR and UK GDPR.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us through our Privacy Center. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfill your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. CONTACT US
If you have any questions regarding this notice we encourage you to contact us at privacy@wiz.io. If you wish to exercise your rights, you can visit our Privacy Center.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective August 15th 2024 to October 23rd 2024
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 14 August 2024
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
h. When we use the Personal Data of our customers/end-users (e.g. when we communicate with customers, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: In connection with your use of the Services we may collect data that we believe may be potentially related to unauthorized third parties, such as malware, and other suspicious files or potentially harmful artifacts. In some cases, this may contain limited Personal Data, such as IP addresses.
- For what purposes: We use this information to analyze and identify potentially suspicious patterns of malicious behavior to prevent, investigate, or notify of threats, and to improve the Services. We may disclose this information to third parties.
- Legal basis:
- Legitimate interest (to provide and improve the Services and for threat intelligence)
- Consequences of not providing the Personal Data: Certain Services features may not be available or may not be improved.
j. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
k. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
l. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
m. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
n. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.)
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your Personal Data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction).
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
- Personal Data we collect or receive for these purposes: Visual images collected via closed circuit cameras.
- For what purposes: For the purpose of protecting the physical security of the offices, to safeguard our offices, people and data, and to comply with our contractual obligations (e.g., with customers and insurers).
- Legal basis: Legitimate interest (to protect and secure our offices)
- Consequences of not providing the Personal Data: We cannot protect and secure our offices and comply with our contractual obligations.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Other service providers to the extent required to fulfil the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR protected Personal Data outside of the EEA or UK (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR and UK GDPR.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us at privacy@wiz.io. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfil your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. CONTACT US
If you have any questions regarding this notice, or if you wish to exercise your rights, we encourage you to contact us at privacy@wiz.io.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective August 1st 2024 to August 15th 2024
DownloadTable of Contents
Wiz Privacy Policy
Last updated: 25 July 2024
Table of Contents:
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
This privacy policy ("Privacy Policy") describes how we, Wiz, Inc. and our affiliates ("we", "our" or "us") process, use, collect and store Personal Information (defined below) that we receive from or about you ("you") in connection with your use of the Wiz website, any websites owned or operated by Wiz, and our service offerings (collectively referred to herein as the "Services"). Please read this Privacy Policy carefully, so you can fully understand our practices in relation to your Personal Information. Important note: Nothing in this Privacy Policy is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.
In situations where Wiz is providing Services to our customer where the customer entity has entered into an agreement for use of the services with Wiz, Wiz is the processor/service provider (a provider that processes Personal Data on behalf of or at the direction of a controller, or other similar designation under the law) and the customer entity is the controller/business (the entity that decides how and why information is processed) of the information provided to Wiz via use of the Services. In such situations, our processing of your Personal Information may also be subject to an applicable data processing agreement with our customer. In the event of a conflict between the data processing agreement and this Privacy Policy, the data processing agreement governs.
"Personal Information" and/or "Personal Data" mean any information that can be used, alone or together with other data, to uniquely identify any living human being and any information deemed as Personally Identifiable Information by applicable privacy laws.
Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions. For example, some jurisdictions require that we provide you with the "legal basis" for processing your Personal Information, and we have included this information below.
We may update this Privacy Policy from time to time and therefore we ask you to check back periodically for the latest version. If we implement any significant changes to the use of your Personal Information in a manner different from that stated at the time of collection, we will notify you by posting a notice on our website or by other means in accordance with applicable legal requirements.
2. TERMS OF USE
This Privacy Policy forms part of our Website Terms of Use ("Terms"). Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Terms.
3. WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
a. When you browse or use our Services
- Personal Data we collect: We may use analytics tools, cookies, other similar technologies and log files in our Services which may collect information such as IP address, pages clicked, events, search and browser information, and device information. For more information about our use of cookies, please read our Cookies Policy
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
b. When you request a demo
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
d. When you contact us
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
e. When you apply for a job with us
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
f. When you provide us with your Personal Data for marketing reasons (e.g. when you attend a physical or virtual marketing event or webinar, and/or provide us with your business card)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications
g. When we acquire your Personal Data from third-party sources for marketing (e.g. lead-generation companies or as part of marketing campaigns)
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
h. When we use the Personal Data of our customers/end-users (e.g. when we communicate with customers, when you log-in to and use our online products and services)
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
i. When you apply to be a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
j. When we use the Personal Data of our service providers
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
k. When you interact with us on our social media profiles (e.g., Facebook, Instagram, Twitter, LinkedIn)
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
l. When we undertake social media marketing, including via use of audiences or list-based advertising
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
N.B. Please note that social media platforms may set cookies and other tracking technologies on your device when you visit their pages and when you navigate from their pages. The output of such information may be provided to us (usually for statistical purposes to see how users interact with our content on social media platforms). The social media platforms are responsible for how they handle your Personal Information and information about how these social media platforms collect and use your Personal Information (and how they use cookies and other technologies, including instructions on how you can disable these) can usually be found in their respective privacy policies and cookies policies on their websites.
m. When you participate in our community research, contest, and education websites (e.g., capture the flag competitions, challenges, etc.)
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, business address, telephone number, country, username, link to the social media profile of your choice, and password.
- For what purposes: We will use this information to register you in these efforts, provide you with the ability to save your progress, and reward eligible participants where applicable. Some of this Personal Data can also be publicly disclosed on a leaderboard as part of the competition. If you do not want us to disclose your personal data publicly, you will need to include a username and a social media link that do not identify you. Wiz will not use the information you enter to register and login for any other purpose. If you express an interest in being contacted by Wiz (for example, if you fill out a separate form so that Wiz to contact you on that website), Wiz will use your information for the purposes identified to you and other marketing purposes (see section f above). Only strictly necessary cookies will be used on these websites, as applicable (otherwise, a cookie banner will be presented to you depending on your jurisdiction).
- Legal basis:
- Legitimate interest (to provide an experience that any interested parties in the security community can benefit from)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data:
- You will not be able to compete in the challenge or obtain the full experience of the initiative.
Finally, please note that some of the abovementioned Personal Information may be used for detecting, taking steps to prevent, and prosecution of fraud or other illegal activity, to identify and repair errors, to conduct audits, and for security purposes. Personal Information may also be used to comply with applicable laws, with investigations performed by the relevant authorities, law enforcement purposes, and/or to exercise or defend legal claims.
In certain cases, we may or will anonymize or de-identify your Personal Information and further use it for internal and external purposes, including, without limitation, to improve our Services and for research and development purposes. "Anonymous Information" means information which does not enable identification of an individual user, such as aggregated information about the use of our Services. We may use Anonymous Information and/or disclose it to third parties without restrictions (for example, in order to improve our Services and enhance your experience with them).
4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
Depending on the context described above, we may disclose your Personal Data to the following categories of third parties:
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Other service providers to the extent required to fulfil the purposes listed above
We may also disclose your Personal Data as follows:
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
5. HOW WE PROTECT AND STORE YOUR INFORMATION
a. Security: We have implemented appropriate technical, organizational and security measures designed to protect your Personal Information. However, please note that we cannot guarantee that the information will not be compromised including as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user IDs and passwords, please make sure to take appropriate measures to protect this information.
b. Retention of your Personal Information. We may store your Personal Information for as long as necessary to fulfil the purpose for which we collected it, and as long as necessary to fulfill your requests or inquiries or provide Services or until we proactively delete it or you send a valid deletion request. In addition, in some circumstances we may store your Personal Information for longer periods of time, for example (i) where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings. We have an internal data retention policy to ensure that we do not retain your Personal Data perpetually. Regarding retention of cookies, you can read more in our Cookies Policy.
6. ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
a. Internal transfers: Transfers within the Wiz group will be covered by an internal data processing agreement between entities of the Wiz group which contractually obliges each member to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred to.
b. External transfers: When Wiz engages in transfers of GDPR and/or UK GDPR protected Personal Data outside of the EEA or UK (for example to third party service providers for the purposes listed above), we generally rely on either: (i) Adequacy Decisions adopted by the European Commission under Article 45 of the GDPR (for example, when our team accesses Personal Data from Israel); (ii) the Standard Contractual Clauses issued by the European Commission or the United Kingdom (as updated from time to time); or (iii) another lawful transfer mechanism provided for under the GDPR e.g. Binding Corporate Rules. Wiz also monitors the circumstances surrounding such transfers to ensure that Personal Data continues to be afforded a level of protection that is essentially equivalent to the one guaranteed by the GDPR and UK GDPR.
7. YOUR PRIVACY RIGHTS
a. Rights: The following rights (which may be subject to certain exemptions or derogations) may apply to certain individuals depending on their jurisdiction of residence. The rights that may be applicable to you are as follows:
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
b. To the extent privacy laws applicable to you afford you with the rights referenced above, we will respect your rights and comply with such laws. You can exercise your rights by contacting us at privacy@wiz.io. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly in accordance with applicable law or inform you if we require further information in order to fulfil your request.
c. Notice of Right to Opt Out of Sales of Personal Information and Sharing/Processing of Personal Information for Targeted Advertising Purposes. Certain U.S. states provide residents with the ability to opt out of the "sale" of their Personal Information or the "sharing/processing" of their Personal Information for cross-context behavioral and advertising purposes. As discussed above in Section 3(l), we may engage in certain online advertising activities through social media and by re-targeting advertising for our Services on other websites. We may use third-party ad networks to assist in these activities, which involves their collection of cookie and device identifier information to perform these activities. Under certain U.S. state laws you have the right to opt out of these activities. If you would like to opt out of our online disclosure such as through cookie and pixel technology of your Personal Information for purposes that could be considered "sales" or "sharing" for purposes of cross-contextual behavioral advertising, please click the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. You can also submit a request to opt out of our offline disclosures of Personal Information that are subject to applicable opt out rights by clicking here. Please note that if you have a legally-required browser-based opt out preference signal turned on via your device browser (e.g., the Global Privacy Control), we recognize such preference in accordance with applicable law.
d. To help protect the security of your Personal Data, Wiz will verify your identity in connection with any requests. We also take steps to ensure that only you or your authorized representative can exercise rights with respect to your information. If you are an authorized agent making a request, we may require and request additional information to protect the Personal Data entrusted to Wiz, including information to verify that you are authorized to make that request. There may be situations where we cannot grant your request, for example, in the event that your request would adversely affect the rights and freedoms of others (for example, would impact the duty of confidentiality we owe to others) or if we are legally entitled to deal with your request in a different way than initially requested, we will address your request to the maximum extent possible, all in accordance with applicable law.
e. We will not discriminate against you (e.g., by restricting or denying you access to our Services) because of choices and requests you make in connection with your Personal Data. Please note, certain choices may affect our ability to deliver the Services. For example, if you sign up to receive marketing communications by email, then ask Wiz to delete all of your information, we will be unable to send you marketing communications. You may exercise any of your rights in relation to your Personal Information by contacting us using the details provided under the "CONTACT US" section below.
8. USE BY CHILDREN
We do not offer our Services for use by children and, therefore, we do not knowingly collect Personal Information from, and/or about children under the age of eighteen (18). If you are under 18, you may not use the Website or Services, or provide any information to the Website without involvement of a parent or a guardian. In the event that we become aware that you provide Personal Information in violation of applicable laws, we reserve the right to delete it. If you believe that we might have any such information, please contact us at privacy@wiz.io.
9. LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
Our Website or Services may enable you to interact with or contain links to your third party accounts and other third party websites, mobile software applications and products or services that are not owned or controlled by us (each a "Third Party Service"). We are not responsible for the privacy practices or the content of such Third Party Services. Please be aware that Third Party Services may collect Personal Information from you. Accordingly, we encourage you to read the terms and conditions and privacy policies of each Third Party Service that you choose to use or interact with.
10. DO NOT TRACK NOTICE
Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not currently respond to or honor DNT signals. As explained above in Section 7, however, we do honor legally-required browser-based opt out preference signals such as the Global Privacy Control.
Please refer to our Cookies Policy for information about cookies and other tracking tools Wiz uses on our Website.
11. PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. Please see the "What Personal Information we collect and how we use it" and the "How we disclose your Personal Information" sections above in our Privacy Policy for detailed information about our data collection and use practices, as well as for more information about our advertising practices. The following chart details the categories of Personal Information that we sell/share with third parties:
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Your Choices Regarding "Sharing" and "Selling": You have the right to opt out of our sale/sharing of your personal information for purposes of online advertising by clicking the ‘Do Not Sell or Share My Personal Information’ link in the footer of the Wiz.io website here. To opt out of the offline disclosure of your personal information to third parties for these purposes, please click here. Please note that there may be circumstances in which we are entitled by law to continue to sell or share your Personal Data. Also note that your withdrawal of consent shall not affect our right to request your consent to such sell or share again after twelve (12) months.
Other CCPA Rights. If we ever offer any financial incentives in exchange for your personal information, we will provide you with appropriate information about such incentives. The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. Please see Section 7 of the Privacy Policy, "Your Privacy Rights," for information about the additional rights you have with respect to your personal information under California law and how to exercise them.
California "Shine the Light" disclosure. The California "Shine the Light" law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such disclosure. For more information about our compliance under the Shine the Light law please contact us via privacy@wiz.io.
12. CONTACT US
If you have any questions regarding this notice, or if you wish to exercise your rights, we encourage you to contact us at privacy@wiz.io.
In addition, VeraSafe has been appointed as Wiz's representative in the EEA for data protection matters, pursuant to Article 27 of the GDPR. If you are in the EEA, VeraSafe can be contacted in addition to Wiz, only on matters related to the processing of Personal Data. To make such an inquiry, you may contact VeraSafe using this contact form: https://verasafe.com/public-resources/contact-data-protection-representative or via telephone at: +420 228 881 031.
Alternatively, VeraSafe can be contacted at: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands.
If you live in the EEA, the UK or Switzerland, Wiz Cloud Limited, located at Suite 4, 7th Floor, 50 Broadway London, SW1H 0DB, is the data controller for your Personal Information.
Effective May 6th 2024 to August 1st 2024
DownloadTable of Contents
Last updated: 19 November 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
- Personal Data we collect: We may use analytics tools, cookies and log files in our Services which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
c. When you subscribe for our blog or newsletter, status page or to receive updates to our sub-processor list
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective November 20th 2023 to May 6th 2024
DownloadTable of Contents
Last updated: 19 November 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR PERSONAL INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
- Personal Data we collect: We may use analytics tools, cookies and log files in our Services which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Services and marketing and promotional efforts. We may disclose this information to third party platforms
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Services to work, marketing)
- Consequences of not providing the Personal Data: Certain Services features may not be available and we may not be able to analyze usage of our Services or use the Personal Data for the purposes explained
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
c. When you subscribe for our blog or newsletter, status page or to receive updates to our sub-processor list
- Personal Data we collect: Full name, business email address, any other Personal Data that you decide to provide us with
- For what purposes: To send you communications for which you have subscribed to and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters or updates which you have subscribed to, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes Personal Data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing communications
- Personal Data we collect: Full name, email address, any Personal Data contained in your resume (CV), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding the Services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding the Services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide to the extent it includes Personal Data. If you are a member of any of the Wiz Communities, any information including Personal Data that you choose to provide in any of the communities may be publicly available to other Wiz Communities members.
- Personal Data we collect automatically when you use our Services: When you access or use the Services we automatically collect information about you, including data relating to you use of our Services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Communities
- To send you marketing communications
- To perform sanctions checks and other legally required checks
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, sanctions laws etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement) or to take steps at the request of the partner prior to entering a contract (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer, marketing)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish a business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about the Services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our Services via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our Services, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- Chat and support tools. We use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Sanctions checks and other legally required checks
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Our partners that offer products and services either in connection with our Services or separately that we think would be of interest to you
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective November 17th 2023 to November 20th 2023
DownloadTable of Contents
Last updated: 15 February 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
- Personal Data we collect: We may use analytics tools, cookies and log files on our Website which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Website and our Services and marketing and promotional efforts. We may disclose this information to third party platforms.
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Website to work, marketing)
- Consequences of not providing the Personal Data: Certain Website features may not be available and we may not be able to analyze usage of our Website or use the Personal Data for the purposes explained.
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services.
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
c. When you subscribe for our blog or newsletter, status page or to receive updates to our sub-processor list
- Personal Data we collect: Full name, business email address
- For what purposes: To send you communications for which you have subscribed you have and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters, marketing or updates which you have subscribed to)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes personal data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing
- Personal Data we collect: Full name, email address, any personal data contained in your resume (c.v.), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (e.g. marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications.
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding Wiz’s services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide. If you are part of the Wiz Community Forum, any information including Personal data that you choose to provide in the Forum may be publicly available to other Wiz Community Forum Users.
- Personal Data we collect automatically when you use our services: When you access or use the Services we automatically collect information about you, including data relating to you use of our services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Community Forum
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title,/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider or distributor is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish and business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about Wiz’s services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our products and services to via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our products, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- We also use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our business partners with whom we jointly offer products or services;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective November 17th 2023 to November 17th 2023
DownloadTable of Contents
Last updated: 15 February 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
- Personal Data we collect: We may use analytics tools, cookies and log files on our Website which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Website and our Services and marketing and promotional efforts. We may disclose this information to third party platforms.
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Website to work, marketing)
- Consequences of not providing the Personal Data: Certain Website features may not be available and we may not be able to analyze usage of our Website or use the Personal Data for the purposes explained.
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services.
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
c. When you subscribe for our blog or newsletter, status page or to receive updates to our sub-processor list
- Personal Data we collect: Full name, business email address
- For what purposes: To send you communications for which you have subscribed you have and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters, marketing or updates which you have subscribed to)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes personal data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing
- Personal Data we collect: Full name, email address, any personal data contained in your resume (c.v.), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (e.g. marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications.
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding Wiz’s services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide. If you are part of the Wiz Community Forum, any information including Personal data that you choose to provide in the Forum may be publicly available to other Wiz Community Forum Users.
- Personal Data we collect automatically when you use our services: When you access or use the Services we automatically collect information about you, including data relating to you use of our services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Community Forum
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title,/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider or distributor is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish and business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about Wiz’s services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our products and services to via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our products, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- We also use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our business partners with whom we jointly offer products or services;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective September 11th 2023 to November 17th 2023
DownloadTable of Contents
Last updated: 15 February 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
- Personal Data we collect: We may use analytics tools, cookies and log files on our Website which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Website and our Services and marketing and promotional efforts. We may disclose this information to third party platforms.
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Website to work, marketing)
- Consequences of not providing the Personal Data: Certain Website features may not be available and we may not be able to analyze usage of our Website or use the Personal Data for the purposes explained.
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services.
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
c. When you subscribe for our blog or newsletter, status page or to receive updates to our sub-processor list
- Personal Data we collect: Full name, business email address
- For what purposes: To send you communications for which you have subscribed you have and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters, marketing or updates which you have subscribed to)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes personal data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing
- Personal Data we collect: Full name, email address, any personal data contained in your resume (c.v.), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (e.g. marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications.
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding Wiz’s services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide. If you are part of the Wiz Community Forum, any information including Personal data that you choose to provide in the Forum may be publicly available to other Wiz Community Forum Users.
- Personal Data we collect automatically when you use our services: When you access or use the Services we automatically collect information about you, including data relating to you use of our services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Community Forum
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title,/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider or distributor is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish and business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about Wiz’s services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our products and services to via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our products, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- We also use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our business partners with whom we jointly offer products or services;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective August 2nd 2023 to September 11th 2023
DownloadTable of Contents
Last updated: 15 February 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
- Personal Data we collect: We may use analytics tools, cookies and log files on our Website which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Website and our Services and marketing and promotional efforts. We may disclose this information to third party platforms.
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Website to work, marketing)
- Consequences of not providing the Personal Data: Certain Website features may not be available and we may not be able to analyze usage of our Website or use the Personal Data for the purposes explained.
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services.
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address
- For what purposes: To send you communications for which you have subscribed you have and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters, marketing or updates which you have subscribed to)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes personal data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing
- Personal Data we collect: Full name, email address, any personal data contained in your resume (c.v.), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (e.g. marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications.
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding Wiz’s services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide. If you are part of the Wiz Community Forum, any information including Personal data that you choose to provide in the Forum may be publicly available to other Wiz Community Forum Users.
- Personal Data we collect automatically when you use our services: When you access or use the Services we automatically collect information about you, including data relating to you use of our services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Community Forum
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title,/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider or distributor is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish and business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about Wiz’s services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our products and services to via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our products, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- We also use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our business partners with whom we jointly offer products or services;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Effective June 12th 2023 to August 2nd 2023
DownloadTable of Contents
Last updated: 15 February 2023
- INTRODUCTION
- TERMS OF USE
- WHAT PERSONAL INFORMATION WE COLLECT AND HOW WE USE IT
- HOW WE DISCLOSE YOUR PERSONAL INFORMATION
- HOW WE PROTECT AND STORE YOUR INFORMATION
- ADDITIONAL INFORMATION REGARDING TRANSFERS OF GDPR PROTECTED PERSONAL DATA
- YOUR PRIVACY RIGHTS
- USE BY CHILDREN
- LINKS TO AND INTERACTION WITH THIRD PARTY PRODUCTS
- DO NOT TRACK NOTICE
- PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS
- CONTACT US
1. INTRODUCTION
- Personal Data we collect: We may use analytics tools, cookies and log files on our Website which may collect information such as IP address, pages clicked, search and browser history, and device information. For more information about our use of cookies, please read our Cookies Policy.
- For what purposes: We use this information to analyze trends and behavior, maintain and improve the Website and our Services and marketing and promotional efforts. We may disclose this information to third party platforms.
- Legal basis:
- Consent (e.g., non-essential cookies, to the extent required under applicable law)
- Legitimate interest (e.g., essential cookies for the Website to work, marketing)
- Consequences of not providing the Personal Data: Certain Website features may not be available and we may not be able to analyze usage of our Website or use the Personal Data for the purposes explained.
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, any other Personal Data that you decide to provide us with. We may also record the demo and/or follow up sessions for the purposes of business intelligence and improving our Services.
- For what purposes:
- To provide you with a demo
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (to provide you with a demo or trial, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot provide you a demo or send you marketing communications
- Personal Data we collect: Full name, business email address
- For what purposes: To send you communications for which you have subscribed you have and other marketing communications
- Legal basis:
- Legitimate interest (to provide you with access to our blog or newsletters, marketing or updates which you have subscribed to)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot send you such communications
- Personal Data we collect: Full name, business email address, company, job title, work telephone number, country, message (to the extent it includes personal data) and any other Personal Data that you decide to provide us with
- For what purposes:
- To answer your questions
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering a contract i.e. subscription agreement
- Legitimate interest (e.g., to answer your questions, marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot answer your questions or send you marketing
- Personal Data we collect: Full name, email address, any personal data contained in your resume (c.v.), your responses to any assessment, background check results (in accordance with applicable law), any other Personal Data that you decide or agree to provide us with such as if you agree for your interview or assessment to be recorded. Please note that, in most cases, we receive the information directly from you, but we may also receive information from recruitment companies, references or background check companies.
- For what purposes: To assess you as a candidate, review and examine your job application and communicate with you regarding your application.
- Legal basis
- Performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract i.e. employment contract
- Legitimate interest (to assess you as a candidate, recruitment)
- Consequences of not providing the Personal Data: We cannot process your application or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country, any other Personal Data that you decide to provide us with
- For what purposes: To establish a business relationship with you, contact you about Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (e.g. marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot establish a business connection or send you marketing communications.
- Personal Data we collect: Full name, business email address, job title, company, address, telephone number, country
- For what purposes: To contact you regarding Wiz’s services and send you marketing communications
- Legal basis:
- Legitimate interest (marketing)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot contact you regarding Wiz’s services and send you marketing communications
- Personal Data we collect directly from you or from your employer who provides us with your contact details: Full name, business email address, Wiz password (if you have a Wiz account), job title, role, company, address, telephone number, country and any other Personal Data that you decide to provide us with e.g. any feedback you provide. If you are part of the Wiz Community Forum, any information including Personal data that you choose to provide in the Forum may be publicly available to other Wiz Community Forum Users.
- Personal Data we collect automatically when you use our services: When you access or use the Services we automatically collect information about you, including data relating to you use of our services e.g. pages visited, IP address and browser information, access times.
- For what purposes:
- To allow you to register for and log-in to our Services
- To provide our Services and perform our agreements with our customers
- For billing and account management
- To provide support (e.g. ticketing and chat function)
- To monitor our Services
- To collect analytics information on use of the Services
- For security purposes, including for user authentication, logging and debugging and to prevent system abuse
- To maintain and improve our Services
- To communicate with you and allow you to provide feedback on our Services
- To enable you to participate in and contribute to the Wiz Community Forum
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the customer is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to provide and improve our Services, send contract-related communications, marketing or updates about features or services)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We cannot perform our obligations, provide the Services, or communicate with you.
- Personal Data we collect: Full name, job title,/function, business email address, business telephone number, country of residence, company name, any other Personal Data that you decide to provide us with.
- For what purposes:
- To enable your company to become a Wiz partner / integrate with Wiz
- To communicate with you
- To comply with our legal obligations and record keeping
- To send you marketing communications
- Legal basis:
- Performance of a contract to which the partner is a party (partner / integration agreement)
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: You cannot become a Wiz partner / integrate with Wiz
- Personal Data we collect: Full name, business email address, job title, company, business address, telephone number, country, payment information, any other Personal Data that you decide to provide us with
- For what purposes:
- To perform our agreement with you
- To communicate with you
- To comply with our legal obligations and record keeping
- Legal basis:
- Performance of a contract to which the service provider or distributor is a party
- Compliance with a legal obligation (e.g. tax laws, bookkeeping laws, etc.)
- Legitimate interest (to send you contract-related communications, to perform our agreement with your employer)
- Consequences of not providing the Personal Data: We cannot perform the agreement with you or communicate with you
- Personal Data we collect: Full name, business email address, job title, company, telephone number, any other Personal Data you provide us
- For what purposes: To respond to your requests, establish a business relationship and send you marketing communications
- Legal basis:
- Legitimate interest (responding to your request, marketing, and business development)
- Consent (for marketing, if required under applicable law)
- Consequences of not providing the Personal Data: We can’t respond to your requests, establish and business relationship and send you marketing communications
- Personal Data we collect or receive for these purposes: Full name, business email address, job title, company, telephone number, IP address, pages clicked, search and browser history, device information and any other Personal Data you or third parties provide us
- For what purposes: We may use your Personal Information to contact you via social media platforms in order to establish a business relationship with you and contact you about Wiz’s services. We may also use your Personal Information in order to create lists of individuals that we would like to target advertising about our products and services to via social media channels, including via direct messaging marketing solutions. You may be included in such a list (in which case you will see advertising related to Wiz when you visit those social media platforms) or we may use your Personal Information to ask social media platforms to identify a list of other individuals who we think will be interested in our products, so that those individuals can be presented with advertising about Wiz.
- Legal basis:
- Legitimate interest (marketing, advertising and business development)
- Consent (if required by applicable law)
- Consequences of not providing the Personal Data: We can’t establish a business relationship with you via social media platforms; you will be excluded from advertising and marketing campaigns on social medial platforms.
- Hosting/ storage
- Email system provider
- Authentication
- Support and ticketing
- Logging and monitoring
- Marketing
- Event sponsors
- CRM
- Data enrichment
- E-mail verification
- Sales Engagement
- Sales automation
- Analytics and business intelligence
- We also use third party vendors to provide chat and support tools via our Website and in-app such as customer service chats, enquiries and to collect information on those interactions
- Document management / automation
- Conducting background checks (if you are applying for a job with us)
- Automation / management of HR and job application process
- Other service providers to the extent required to fulfil the purposes listed above
- to the extent necessary in our good faith determination, with regulators, courts or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order;
- with our business partners with whom we jointly offer products or services;
- with our affiliated companies to the extent necessary to fulfill the purposes listed above;
- if, in the future, we sell or transfer some or all of our business, shares, or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business, shares or assets. In the event that we are acquired by or merged with a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer or assign Personal Information in connection with the foregoing events;
- with social media platforms for the purposes mentioned above;
- where you have provided your consent to us disclosing or transferring the Personal Information.
- You have a right to access Personal Data held about you. Your right of access may normally be exercised free of charge, however we reserve the right to charge an appropriate administrative fee where permitted by applicable law;
- You have the right to request that we rectify any Personal Data we hold that is inaccurate or misleading;
- You have the right to request the erasure/deletion of your Personal Data (e.g. from our records). Please note that there may be circumstances in which we are required to retain your Personal Data, for example for the establishment, exercise or defense of legal claims;
- You have the right to object, to or to request restriction, of the processing;
- You have the right to data portability. This means that you may have the right to receive your Personal Data in a structured, commonly used and machine-readable format, and that you have the right to transmit that data to another controller;
- You have the right to object to profiling, if applicable;
- You have the right to withdraw your consent at any time. Please note that there may be circumstances in which we are entitled to continue processing your data, in particular if the processing is required to meet our legal and regulatory obligations. Also, please note that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
- You also have a right to request certain details of the basis on which your Personal Data is transferred outside the European Economic Area or the United Kingdom, as applicable, but data transfer agreements and/or other details may need to be partially redacted for reasons of commercial confidentiality;
- You have a right to lodge a complaint with your local data protection supervisory authority (i.e., your place of habitual residence, place or work or place of alleged infringement) at any time or before the relevant institutions in your place of residence. We ask that you please attempt to resolve any issues with us before you contact your local supervisory authority and/or relevant institution.
Category of Personal Information | Categories of Third Parties to Which We Sell/Share this Category of Personal Information |
Device identifiers and Service usage information | Ad networks and advertising analytics partners |
Email address | Ad networks and advertising analytics partners |
Data Processing Agreement
Effective September 29th 2025
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, the United States, Australia, Canada, Israel, Japan and Singapore, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws.For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. As between the Parties, Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, to the extent applicable, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business or, where Customer is acting behalf of its own customers, a Processor, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3 Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations (“Permitted Auditor”)) a copy of Wiz’s then most recent third-party audits or certifications. Any certifications and/or documentation made available by Wiz to Customer in accordance with this Section shall be Wiz’s Confidential Information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control. To the greatest extent possible, Customer shall utilize Wiz’s certifications and other privacy documentation and policies made available to Customer on Wiz’s Trust Center to assess Wiz’s compliance with its obligations this DPA. Only to the extent that Customer is not able to do so, and in any event, no more than once per year (except if otherwise required by applicable law) and following at least 45 days’ notice in writing from Customer, at Customer’s cost and expense, Wiz shall allow for and contribute to remote audits conducted by Customer or a Permitted Auditor. The Parties shall agree on the scope, methodology, timing and conditions of such audits in advance. Customer shall use reasonable endeavors to ensure that the conduct of each audit does not disrupt Wiz’s business. In no event shall Customer be permitted to access any information, including without limitation, data that belongs to Wiz’s other customers or such other information that is not relevant to Wiz’s compliance with this the DPA. Unless otherwise agreed by the Parties, Customer shall use reasonable efforts to carry out the audit of Wiz’s compliance with this DPA together with the audit of Wiz’s compliance with the Security Addendum.
8. TRANSFERS OF DATA
8.1 Transfers of Customer Personal Data. Wiz may transfer Customer Personal Data outside of its country of origin as reasonably required to provide the Services , in accordance with its operating model and subject to the obligations set forth in this DPA.
8.2 Transfers to countries that offer adequate level of data protection. Customer Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.3 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.4 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz shall comply with its obligations under US Privacy Laws, including by providing the level of privacy protection as is required by US Privacy Laws to Customer Personal Data subject to the US Privacy Laws. Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data for any purpose other than the contractual business purpose set forth herein or as otherwise permitted under US Privacy Laws or outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 To the extent required under US Privacy Laws, Customer may take reasonable and appropriate steps to help to ensure that Wiz uses Customer Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws and to stop and remediate unauthorized use of the Customer Personal Data.
9.4 Wiz certifies that it understands its obligations in this Clause 9.The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defense of legal claims and/or to comply with applicable laws and regulations.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer and complying with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Depending on the Customer’s environment and naming conventions and features used by Customer, some Personal Data may be included in the metadata findings. For example, cloud user account names, logs and artifacts could include an individual’s name, associated email address, professional phone number and IP address as well as information about device and operating system and (if specific Wiz features are used) samples of findings to enable Customer to locate, verify and remediate the finding(s).
- Any other Customer Personal Data that Customer shares with Wiz for the purpose of providing the services.
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1. In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the Extended EEA Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2. The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3. If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4. If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6. Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.7. Except where paragraph 1.7 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a) “Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b) “the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c) “supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services. If Customer uses Wiz’s features specifically designed to scan data stores via a SaaS deployment, Wiz will temporarily Process any Special Category data included within the data source(s) that Customer connects for scanning. |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective April 14th 2025 to September 29th 2025
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws.For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. As between the Parties, Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, to the extent applicable, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business or, where Customer is acting behalf of its own customers, a Processor, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3 Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations (“Permitted Auditor”)) a copy of Wiz’s then most recent third-party audits or certifications. Any certifications and/or documentation made available by Wiz to Customer in accordance with this Section shall be Wiz’s Confidential Information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control. To the greatest extent possible, Customer shall utilize Wiz’s certifications and other privacy documentation and policies made available to Customer on Wiz’s Trust Center to assess Wiz’s compliance with its obligations this DPA. Only to the extent that Customer is not able to do so, and in any event, no more than once per year (except if otherwise required by applicable law) and following at least 45 days’ notice in writing from Customer, at Customer’s cost and expense, Wiz shall allow for and contribute to remote audits conducted by Customer or a Permitted Auditor. The Parties shall agree on the scope, methodology, timing and conditions of such audits in advance. Customer shall use reasonable endeavors to ensure that the conduct of each audit does not disrupt Wiz’s business. In no event shall Customer be permitted to access any information, including without limitation, data that belongs to Wiz’s other customers or such other information that is not relevant to Wiz’s compliance with this the DPA. Unless otherwise agreed by the Parties, Customer shall use reasonable efforts to carry out the audit of Wiz’s compliance with this DPA together with the audit of Wiz’s compliance with the Security Addendum.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz shall comply with its obligations under US Privacy Laws, including by providing the level of privacy protection as is required by US Privacy Laws to Customer Personal Data subject to the US Privacy Laws. Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data for any purpose other than the contractual business purpose set forth herein or as otherwise permitted under US Privacy Laws or outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 To the extent required under US Privacy Laws, Customer may take reasonable and appropriate steps to help to ensure that Wiz uses Customer Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws and to stop and remediate unauthorized use of the Customer Personal Data.
9.4 Wiz certifies that it understands its obligations in this Clause 9.The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defense of legal claims and/or to comply with applicable laws and regulations.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer and complying with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Depending on the Customer’s environment and naming conventions and features used by Customer, some Personal Data may be included in the metadata findings. For example, cloud user account names, logs and artifacts could include an individual’s name, associated email address, professional phone number and IP address as well as information about device and operating system and (if specific Wiz features are used) samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1. In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the Extended EEA Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2. The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3. If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4. If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6. Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.7. Except where paragraph 1.7 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a) “Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b) “the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c) “supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services. If Customer uses Wiz’s features specifically designed to scan data stores via a SaaS deployment, Wiz will temporarily Process any Special Category data included within the data source(s) that Customer connects for scanning. |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective August 26th 2024 to April 14th 2025
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws.For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. As between the Parties, Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, to the extent applicable, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business or, where Customer is acting behalf of its own customers, a Processor, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3 Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz shall comply with its obligations under US Privacy Laws, including by providing the level of privacy protection as is required by US Privacy Laws to Customer Personal Data subject to the US Privacy Laws. Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data for any purpose other than the contractual business purpose set forth herein or as otherwise permitted under US Privacy Laws or outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 To the extent required under US Privacy Laws, Customer may take reasonable and appropriate steps to help to ensure that Wiz uses Customer Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws and to stop and remediate unauthorized use of the Customer Personal Data.
9.4 Wiz certifies that it understands its obligations in this Clause 9.The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defense of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer and complying with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Depending on the Customer’s environment and naming conventions and features used by Customer, some limited Personal Data may be included in the metadata findings. For example, cloud user account names, logs and artifacts could include an individual’s name, associated email address, professional phone number and IP address as well as information about device and operating system and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1. In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the Extended EEA Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2. The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3. If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4. If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6. For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7. Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8. Except where paragraph 1.7 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a) “Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b) “the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c) “supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services. If Customer uses Wiz’s features specifically designed to scan data stores via a SaaS deployment, Wiz will temporarily Process any Special Category data included within the data source(s) that Customer connects for scanning. |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective April 18th 2024 to August 26th 2024
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws.For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. As between the Parties, Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, to the extent applicable, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business or, where Customer is acting behalf of its own customers, a Processor, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3 Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz shall comply with its obligations under US Privacy Laws, including by providing the level of privacy protection as is required by US Privacy Laws to Customer Personal Data subject to the US Privacy Laws. Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data for any purpose other than the contractual business purpose set forth herein or as otherwise permitted under US Privacy Laws or outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 To the extent required under US Privacy Laws, Customer may take reasonable and appropriate steps to help to ensure that Wiz uses Customer Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws and to stop and remediate unauthorized use of the Customer Personal Data.
9.4 Wiz certifies that it understands its obligations in this Clause 9.The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defense of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer and complying with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Depending on the Customer’s environment and naming conventions and features used by Customer, some limited Personal Data may be included in the metadata findings. For example, cloud user account names, logs and artifacts could include an individual’s name, associated email address, professional phone number and IP address as well as information about device and operating system and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1. In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the Extended EEA Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2. The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3. If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4. If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6. For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7. Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8. Except where paragraph 1.7 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a) “Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b) “the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c) “supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services. If Customer uses Wiz’s features specifically designed to scan data stores via a SaaS deployment, Wiz will temporarily Process any Special Category data included within the data source(s) that Customer connects for scanning. |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective November 20th 2023 to April 18th 2024
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3 Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 To the extent required under US Privacy Laws, Customer may take reasonable and appropriate steps to help to ensure that Wiz uses Customer Personal Data in a manner consistent with Customer’s obligations under US Privacy Laws and to stop and remediate unauthorized use of the Customer Personal Data.
9.4 Wiz certifies that it understands its obligations in this Clause 9.The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14. MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1. Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2. To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3. Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4. Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1 Incorporation and interpretation of the Standard Contractual Clauses
1.1 In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the Extended EEA Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2 The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3 If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4 If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6 For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective November 17th 2023 to November 20th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2Definitions:
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2.CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3.WIZ’S PROCESSING OF PERSONAL DATA
3.1Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4.RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5.WIZ PERSONNEL
5.1Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6.AUTHORIZATION REGARDING SUB-PROCESSORS
6.1Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8.TRANSFERS OF DATA
8.1Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10.PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11.RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12.TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13.RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14.MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1.Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2.To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3.Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4.Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1Incorporation and interpretation of the Standard Contractual Clauses
1.1In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective November 13th 2023 to November 17th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2Definitions:
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/legal/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2.CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3.WIZ’S PROCESSING OF PERSONAL DATA
3.1Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4.RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5.WIZ PERSONNEL
5.1Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6.AUTHORIZATION REGARDING SUB-PROCESSORS
6.1Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2 Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.SECURITY
7.1Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8.TRANSFERS OF DATA
8.1Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10.PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11.RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12.TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13.RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14.MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1.Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2.To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3.Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4.Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1Incorporation and interpretation of the Standard Contractual Clauses
1.1In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a) |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective October 29th 2023 to November 13th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, 	Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, 	the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. 	INTERPRETATION AND DEFINITIONS
1.1 	The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2	Definitions:
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Addendum” means Wiz’s Security Addendum which is available via https://www.wiz.io/security-addendum.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2.	CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3.	WIZ’S PROCESSING OF PERSONAL DATA
3.1	Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2	Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3	Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4	To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4.	RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5.	WIZ PERSONNEL
5.1	Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6.	AUTHORIZATION REGARDING SUB-PROCESSORS
6.1	Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2	Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/legal/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3	Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.	SECURITY
7.1	Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Addendum. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2	Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8.	TRANSFERS OF DATA
8.1	Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 	Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3	In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. 	US PRIVACY LAWS
9.1 	In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2	Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4	The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10.	PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11.	RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12.	TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13.	RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14.	MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1.	Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2.	To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3.	Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4.	Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1	Incorporation and interpretation of the Standard Contractual Clauses
1.1	In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2	The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3	If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4	If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5	Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6	For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 	Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 	Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)	“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)	“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)	“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer:	 | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA	 | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING	 | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a)	 |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply:	 For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Addendum.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective September 19th 2023 to October 29th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in this DPA, the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Wiz in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2. Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/legal/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3. Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7. SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Documentation. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4 The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14. MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1. Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2. To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3. Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4. Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1 In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2 The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3 If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4 If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6 For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Documentation.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective September 11th 2023 to September 19th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2 Definitions:
2. CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3. WIZ’S PROCESSING OF PERSONAL DATA
3.1 Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3 Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in this DPA, the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Company in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4 To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4. RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5. WIZ PERSONNEL
5.1 Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6. AUTHORIZATION REGARDING SUB-PROCESSORS
6.1 Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2. Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/legal/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3. Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7. SECURITY
7.1 Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Documentation. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2 Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8. TRANSFERS OF DATA
8.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3 In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. US PRIVACY LAWS
9.1 In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2 Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4 The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11. RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12. TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14. MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1. Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2. To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3. Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4. Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1. Incorporation and interpretation of the Standard Contractual Clauses
1.1 In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2 The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3 If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4 If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5 Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6 For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer: | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply: For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Documentation.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective August 29th 2023 to September 11th 2023
DownloadTable of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) forms part of the Wiz Master Subscription Agreement or other agreement for Wiz services entered into between the Parties (the “Agreement”) between the Wiz entity that has entered into the Agreement (“Wiz”, “Us”, “We”, “Our”) and Customer (collectively, “You”, “Your”, or “Customer”) pursuant to the Agreement. Both parties shall be referred to as the “Parties” and each, a “Party”. This DPA forms a binding legal agreement to reflect the Parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below).
WHEREAS, 	Wiz shall provide the services set forth in the Agreement (collectively, the “Services”) to Customer, as described in the Agreement; and
WHEREAS, 	the Parties wish to set forth the arrangements concerning the Processing of Personal Data within the context of the Services and agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged by the Parties, the Parties, intending to be legally bound, agree as follows:
1. 	INTERPRETATION AND DEFINITIONS
1.1 	The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise affect the provisions of this DPA. References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated. Words used in the singular include the plural and vice versa, as the context may require. Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.2	Definitions:
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and the United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a Member State of the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or such equivalent term under Data Protection Laws.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Documentation” means Wiz’s security documentation that is applicable to the specific Services purchased by Customer, as updated from time to time, and as made reasonably available by Wiz.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914&qid=1689513765256, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “US Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
2.	CUSTOMER’S PROCESSING OF PERSONAL DATA. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws and comply at all times with the obligations applicable to Controllers or Businesses, as applicable. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the means by which Customer acquired Customer Personal Data. Without limitation, Customer shall comply with any and all transparency-related obligations (including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall have any and all required legal basis in order to collect, Process and transfer to Wiz the Customer Personal Data and to authorize the Processing by Wiz of the Customer Personal Data which is authorized in this DPA.
3.	WIZ’S PROCESSING OF PERSONAL DATA
3.1	Application. As used in clauses 3 – 9 herein, Customer Personal Data refers to Customer Personal Data that is subject to Data Protection Laws.
3.2	Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, (i) Customer is the Controller or Business, (ii) Wiz is the Processor or Service Provider, and (iii) Wiz or its Affiliates may engage Sub-Processors pursuant to the requirements set forth in Clause 6 below.
3.3	Wiz and its Affiliates (as applicable) shall Process Customer Personal Data only in accordance with Customer’s documented instructions, which are set out in this DPA, the Agreement, as necessary for the performance of the Services and for the performance of the Agreement and this DPA, unless required to otherwise by any applicable law, court of competent jurisdiction or other Supervisory Authority to which Wiz and its Affiliates are subject, in which case, Wiz shall inform Customer of the legal requirement before processing, unless that law prohibits such information. Customer agrees that the Agreement is its complete and final instructions to Company in relation to the Processing of Personal Data. Processing any Personal Data outside the scope of the Agreement will require prior written agreement between Wiz and Customer by way of an amendment to the Agreement, and may include any additional fees that may be payable by Customer to Wiz for carrying out such instructions. The duration of the Processing, the nature and purposes of the Processing, as well as the types of Customer Personal Data Processed and categories of Data Subjects under this DPA are further specified in Schedule 1 to this DPA.
3.4	To the extent that Wiz or its Affiliates cannot comply with an instruction from Customer and/or its authorized users relating to Processing of Customer Personal Data or where Wiz considers such instruction to be unlawful, Wiz (i) shall inform Customer, providing relevant details of the problem; (ii) may, without any kind of liability towards Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing those data); and (iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing, and Customer shall pay to Wiz all the amounts owed to Wiz or due before the date of termination.
4.	RIGHTS OF DATA SUBJECTS. If Wiz receives a request from a Data Subject to exercise its rights under Data Protection Laws (“Data Subject Request”), Wiz shall, to the extent legally permitted, promptly notify and forward such Data Subject Request to Customer. Taking into account the nature of the Processing, Wiz shall use commercially reasonable efforts to assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws.
5.	WIZ PERSONNEL
5.1	Confidentiality. Wiz shall grant access to the Customer Personal Data to persons under its authority (including, without limitation, its personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Customer Personal Data have committed themselves to confidentiality.
6.	AUTHORIZATION REGARDING SUB-PROCESSORS
6.1	Customer hereby grants general written authorization to Wiz to appoint Sub-Processors to perform specific Processing activities on Customer Personal Data on its behalf. Wiz’s current list of Sub-Processors is included at https://www.wiz.io/sub-processor-list (“Sub-Processor List”) and is hereby approved by Customer.
6.2	Objection Right for Sub-Processors. Wiz offers a mechanism for Customers to subscribe to notifications of changes to Wiz’s Sub-Processor List via https://www.wiz.io/legal/sub-processor-list. If Customer subscribes to receive such updates, Wiz shall provide notification of any intended changes concerning the addition or replacement of other Sub-Processor(s) to the email address which has subscribed thereby giving Customer the opportunity to object. Customer may reasonably object to Wiz’s use of a Sub-Processor for reasons related to the Data Protection Laws by notifying Wiz in writing within ten (10) days after receipt of Wiz’s notice including the reasons for objecting to Wiz’s use of such Sub-Processor. Failure to object to such Sub-Processor in writing within ten (10) days following Wiz’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-Processor, Wiz will use reasonable efforts to make available to Customer a change in the Services to avoid Processing of Customer Personal Data by the objected-to Sub-Processor without unreasonably burdening Customer. If Wiz is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may, as a sole remedy, terminate the Agreement and this DPA by providing written notice to Wiz provided that all amounts due under the Agreement before the termination date shall be duly paid to Wiz. Until a decision is made regarding the Sub-Processor, Wiz may temporarily suspend the Processing of the affected Customer Personal Data.
6.3	Where Wiz engages a Sub-Processor, we shall do so by way of a written contract which imposes on the Sub-Processor substantially the same data protection obligations as in this DPA.
7.	SECURITY
7.1	Controls for the Protection of Customer Personal Data. Taking into account the state of the art, Wiz shall maintain industry-standard technical and organizational measures, including as required pursuant to Article 32 of the GDPR and other applicable Data Protection Laws, for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data, as set forth in the Security Documentation. Upon Customer’s request, Wiz will use commercially reasonable efforts to assist Customer, in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR and other applicable Data Protection Laws taking into account the nature of the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and the information available to Wiz.
7.2	Third-Party Certifications and Audits. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Wiz shall make available to Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and bound by confidentiality obligations) a copy of Wiz’s then most recent third-party audits or certifications, as applicable (provided, however, that any such documentation shall be Wiz’s confidential information and shall only be used by Customer to assess compliance with this DPA, and shall not be used for any other purpose or disclosed to any third party without Wiz’s prior written approval and, upon Wiz’s request, Customer shall return all such documentation in Customer’s possession or control). Only as required by applicable Data Protection Laws and at Customer’s cost and expense, not more than once per year, Wiz shall allow for and contribute to audits, including remote inspections, conducted by Customer (or Customer’s independent, third-party auditor that is not reasonably objected to by Wiz and that is bound by confidentiality obligations) provided that the parties shall agree on the scope, methodology, timing and conditions of such audits and inspections in advance. Notwithstanding anything to the contrary, such audits and/or inspections shall not contain any information, including without limitation, Personal Data that belongs to Wiz’s other customers.
8.	TRANSFERS OF DATA
8.1	Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the Extended EEA Countries to countries or frameworks that offer adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities of the Extended EEA Countries (“Adequacy Decisions”), without any further safeguard being necessary.
8.2 	Transfers to other countries. If, and to the extent, the Processing of Customer Personal Data which is subject to Data Protection Laws of the EEA Extended Countries includes transfers by Customer from the Extended EEA Countries to Wiz in countries outside the Extended EEA Countries which have not been subject to an Adequacy Decision (“Third Countries”), the Parties agree that such transfers shall be undertaken on the basis of the Standard Contractual Clauses, which will be deemed to have been signed by each Party on the Effective Date of this Agreement, are incorporated herein by reference and construed in accordance with Schedule 2 below, unless another mechanism provided for in the Data Protection Laws of the applicable Extended EEA Country applies.
8.3	In the event Customer enables Third Party Integrations (as defined in the Agreement) which involve transfers of Customer Personal Data between Wiz and the Third Party Integration provider, Customer acknowledges and agrees that (a) such Third Party Integration providers are not Sub-Processors of Wiz; (b) such transfers are conducted at Customer’s instruction in accordance with an agreement between the Customer and such Third Party Integration provider (which Wiz is not a party to); and (c) Customer shall be solely responsible for such transfers and their compliance with Data Protection Laws, including without limitation, executing Standard Contractual Clauses with such Third Party Integration providers as required.
9. 	US PRIVACY LAWS
9.1 	In performing its obligations under the Agreement and this DPA, Wiz will not: (1) “sell” or “share” for purposes of “cross-context behavioral advertising” or “targeted advertising” (as defined by applicable US Privacy Laws) any Customer Personal Data; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Wiz and Customer; or (3) attempt to re-identify any pseudonymized, anonymized, aggregate, or de-identified Customer Personal Data.
9.2	Wiz will (1) comply with any applicable restrictions under applicable US Privacy Laws on combining Customer Personal Data with Personal Data that Wiz receives from, or on behalf of, another person or persons; and (2) promptly notify Customer if Wiz determines that it (i) can no longer meet its obligations under this DPA or applicable US Privacy Laws; or (ii) in Wiz’s opinion, an instruction from Customer infringes applicable US Privacy Laws.
9.3 Wiz certifies that it understands its obligations in this Clause 9.
9.4	The Parties agree that Schedule 1 hereto shall satisfy any requirement under applicable U.S. Privacy Law to provide details regarding the nature of the Processing activities related to Customer Personal Data.
10.	PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION. To the extent required under applicable Data Protection Laws, Wiz shall notify Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data (a “Personal Data Incident”). Wiz shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Wiz deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident. Customer (or its customers), as the Controller or Business, will be the party responsible for notifying supervisory authorities and/or concerned Data Subjects (where required by Data Protection Laws).
11.	RETURN AND DELETION OF PERSONAL DATA. Subject to the Agreement, upon termination or expiry of the Services, Wiz shall, make available for return the Customer Personal Data via the Services and delete such Customer Personal Data in accordance with Wiz’s customer data retention & deletion policy unless applicable law requires storage of the Customer Personal Data. In any event, Customer agrees that Wiz may retain Customer Personal Data in accordance with its standard backup policy, for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or to comply with applicable laws and regulations. Notwithstanding anything to the contrary, Customer hereby agrees and understands that, to the extent Wiz performs cloud scanning on behalf of Customer, if and when Customer wants to delete specific Customer Personal Data, Customer may delete such Customer Personal Data from its own databases, and it will automatically be erased from Wiz’s databases within a reasonable market standard timeframe. If Customer requests return of the Customer Personal Data, it shall be returned in an industry standard format generally available for Wiz’s Customers.
12.	TERMINATION. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services are provided, provided that, to the extent Wiz retains any Customer Personal Data following termination or expiration of the Agreement, this DPA shall survive for such period that Wiz retains Customer Personal Data. Clauses 2, 3.4 and 13 shall survive the termination or expiration of this DPA for any reason. This DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13.	RELATIONSHIP WITH AGREEMENT. Subject to any provisions in Schedule 2 regarding governing law and choice of forum of the Standard Contractual Clauses, the governing law and choice of forum provision in the Agreement shall apply to this DPA. In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement. For the avoidance of doubt each Party’s and its Affiliates’ liability, taken together in the aggregate, arising out of or relating to this DPA, the Standard Contractual Clauses, Data Protection Laws and any other data protection agreements in connection with the Agreement (if any), shall be subject to any aggregate limitations on liability set out in the Agreement. NOTWITHSTANDING THE FOREGOING, IF CUSTOMER IS USING THE SERVICES FOR A FREE TRIAL, WIZ’S MAXIMUM AGGREGATE LIABILITY TO CUSTOMER UNDER OR RELATED TO THIS DPA SHALL BE CAPPED AT ONE THOUSAND DOLLARS US ($1,000 US).
14.	MISCELLANEOUS. Any Wiz obligation hereunder may be performed (in whole or in part), and any Wiz right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Wiz. This DPA may be amended by Wiz from time to time in its sole discretion, with such updated version posted to Wiz’s website, provided, however, that no such update shall materially diminish the privacy or security of Customer Personal Data.
List of Schedules
SCHEDULE 1 – DETAILS OF THE PROCESSING
SCHEDULE 2 – STANDARD CONTRACTUAL CLAUSE
SCHEDULE 1
DETAILS OF THE PROCESSING
Subject matter.
Wiz will Process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
Nature and Purpose of Processing.
1.	Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the Service(s) and support and technical maintenance to Customer.
2.	To comply with documented reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement.
3.	Resolving disputes, enforcing the Agreement, this DPA and/or defending Wiz’s rights.
4.	Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities, preventing fraud, money laundering and terrorist financing.
Duration of Processing.
Subject to any section of the DPA and/or the Agreement dealing with the duration of the Processing and the consequences of the expiration or termination thereof, Wiz will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Types of Customer Personal Data.
Customer determines the categories of any Customer Personal Data that is made accessible to Wiz, which may include, without limitation, Customer Personal Data relating to the following categories:
- If Customer uses Wiz for scanning, Personal Data might be temporarily processed by Wiz during the scanning. The type of the Personal Data depends on Customer environment and which sources Customer connects.
- Wiz only stores metadata such as CVEs, misconfigurations, list of installed packages, cloud events, local cloud user accounts, cloud object identifiers and (depending on the features used by Customer) logs and file paths. Such metadata does not generally contain Personal Data, however, depending on the Customer’s environment and naming conventions and the features used by Customer, some limited Personal Data may be included. For example, cloud user account names, logs and artifacts could include an individual’s name, logs could contain names, associated email address and IP address and (if specific Wiz features are enabled) pseudonymized samples of findings to enable Customer to locate, verify and remediate the finding(s).
Customer acknowledges that Wiz does not control which Customer Personal Data Customer shares with it in the context of the Services.
Categories of Data Subjects.
As part of providing the Services, Wiz may process Customer Personal Data related to Customer’s customers or users, leads, employees and service providers, the extent of which is solely determined by Customer.
SCHEDULE 2
STANDARD CONTRACTUAL CLAUSES
1	Incorporation and interpretation of the Standard Contractual Clauses
1.1	In relation to transfers by Customer of Customer Personal Data which are subject to Data Protection Laws of the EEA Extended Countries to Wiz in Third Countries, the parties agree that Module Two (Transfer controller to processor) or Module 3 (Transfer processor to processor) of the Standard Contractual Clauses shall apply, as applicable.
1.2	The Parties acknowledge that the information required to be provided in the Standard Contractual Clauses, including the appendices, is set out in Appendix 1 below.
1.3	If there is a conflict between the provisions of this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail, provided that, except to the extent prohibited by applicable law, the Standard Contractual Clauses shall be interpreted in accordance with and subject to this DPA and the Agreement, including without limitation, the provisions on limitation of liability, instructions, storage, erasure and return of Personal Data, audits and engagement of Sub-Processors.
1.4	If any provision or part-provision of this DPA or the Agreement causes the Standard Contractual Clauses to become an invalid export mechanism in the relevant Extended EEA Country, it shall be deemed deleted but that shall not affect the validity and enforceability of the rest of this Agreement and the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.
1.5	Where requested by Wiz, Customer shall provide reasonable assistance to Wiz and be responsible for issuing such communications to Data Subjects and/or the Controller (to the extent Module Three applies) as are required in order for Wiz to comply with its obligations under the Standard Contractual Clauses.
1.6	For the purpose of Section III, Clause 14 of the Standard Contractual Clauses, the parties acknowledge and agree that, as between the parties, the Customer (acting as data exporter) is responsible for: (i) assessing the laws of the country to which it transfers Personal Data; and (ii) determining whether or not the transfer meets the requirements of Section III, Clause 14(a) of the Standard Contractual Clauses. Where Wiz (as data importer) provides information to the Customer (acting as data exporter) for assisting the Customer in its assessment, such information is provided on an “as is” basis for informational purposes only. Without prejudice to Section III, Clause 14(c) of the Standard Contractual Clauses, Wiz (as data importer) shall not be liable for any losses suffered by the Customer in connection with its assessment.
1.7 	Notwithstanding anything to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is the UK, template Addendum B.1.0 issued by the UK ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, (the “UK Approved Addendum”) shall amend the Standard Contractual Clauses in respect of such transfers and Part 1 of the UK Approved Addendum shall be populated as set out below:
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 3. The “Appendix Information” is as set out in Appendix 1 to this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
1.8 	Except where paragraph 1.9 above applies, but notwithstanding anything else to the contrary, where the applicable Extended EEA Country where the data exporter is established or from where the transferred personal data originated is not a Member State of the European Union, references in the Standard Contractual Clauses to:
(a)	“Member States of the European Union” shall refer to the applicable Extended EEA Country in which the data exporter is established or from where the transferred Personal Data originated (as applicable);
(b)	“the GDPR” shall refer to the Data Protection Laws of the Extended EEA Country in which the data exporter is established or from where the Personal Data originated; and
(c)	“supervisory authority” shall refer to the data protection authority in the Extended EEA Country as determined in Annex I(C) below.
Appendix 1 – Completion of the Standard Contractual Clauses
ANNEX I
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer:	 | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA	 | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING	 | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: the law of the Netherlands. a |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs: the Parties select the courts of the Netherlands. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply:	 For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 (General Written Authorisation) will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
ANNEX II – WIZ SECURITY MEASURES
The technical and organizational measures including technical and organizational measures to support the security of Personal Data incorporated into Annex II of the Standard Contractual Clauses shall be the technical and organizational security measures as described in Wiz’s Security Documentation.
In addition, Wiz agrees to the following compensating safeguards to protect such data to an equivalent level as required under the Data Protection Laws of the Extended EEA Countries to the extent required under the Standard Contractual Clauses:
- Wiz and Customer shall encrypt all transfers of the Customer Personal Data between them, and Wiz shall encrypt any onward transfers it makes of such Customer Personal Data.
- Wiz will use reasonably available legal mechanisms to challenge any demands for Customer Personal Data access through national security process it receives as well as any non-disclosure provisions attached thereto.
- Wiz will promptly notify Customer of any government demands for Customer Personal Data, unless prohibited under applicable law. To the extent Wiz is prohibited by law from providing such notification, Wiz shall: (i) review each request on a case-by-case basis; (ii) use reasonable efforts to request that the confidentiality requirement be waived to enable Wiz to notify the Customer and/or the appropriate Supervisory Authority competent for the Customer; and (iii) maintain evidence of any such attempt to have a confidentiality requirement waived.
- Wiz will promptly notify Customer if Wiz can no longer comply with the applicable clauses in this Section. Wiz shall not be required to provide Customer with specific information about why it can no longer comply, if providing such information is prohibited by applicable law. Such notice shall entitle Customer to terminate the Agreement (or, at Customer’s option, affected statements of work, order forms, and like documents thereunder) and receive a prompt pro-rata refund of any prepaid amounts thereunder.
Effective August 21st 2023 to August 29th 2023
DownloadTable of Contents
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to the Data Protection Laws, and (b) is permitted to use the Services pursuant to the Agreement between Customer and Wiz but has not signed its own agreement with Wiz and is not a “Customer” as defined under the Agreement. For the purposes of the DPA, the term Customer includes Customer Authorized Affiliates to the extent applicable.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a country within the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Documentation” means Wiz’s security documentation that is applicable to the specific Services purchased by Customer, as updated from time to time, and as made reasonably available by Wiz.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “U.S. Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
- Wiz certifies that it understands its obligations in this Clause 9.
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer or Customer Authorized Affiliate as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer or Customer Authorized Affiliate, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer:	 | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA	 | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING	 | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List. |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. Where the data exporter is established outside of the EU, but within an Extended EEA Country, the competent supervisory authority shall be the supervisory authority of the Extended EEA Country in which the Transferring Client Entity is established. Where the data exporter is established outside an Extended EEA Country and the personal data originates from an Extended EEA Country which is not in the EU, the supervisory authority shall be the supervisory authority of the Extended EEA Country from which the Personal Data originated. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: a)	(a) where the data exporter is established in the EU or otherwise if the personal data originates from the EU, the Parties select the laws of the Netherlands; (b) where the data exporter is established outside the EU but within an Extended EEA Country, the Parties select the laws of the Extended EEA Country where the data exporter is established; or (c) subject to (a) above, where the data exporter is established outside an Extended EEA Country, the parties select the laws of the Extended EEA Country where the personal data originates from. |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs:
outside an Extended EEA Country, the parties select the courts of the Extended EEA Country where the personal data originates from. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply:	 For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |
Effective July 5th 2023 to August 21st 2023
DownloadTable of Contents
- “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
- “Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to the Data Protection Laws, and (b) is permitted to use the Services pursuant to the Agreement between Customer and Wiz but has not signed its own agreement with Wiz and is not a “Customer” as defined under the Agreement. For the purposes of the DPA, the term Customer includes Customer Authorized Affiliates to the extent applicable.
- “Controller” or “Business” as relevant under applicable Data Protection Laws, means the entity which determines the purposes and means of the Processing of Personal Data or such equivalent term under Data Protection Laws.
- “Customer Personal Data” means any Personal Data which is provided to and Processed by Wiz on behalf of Customer in order to provide the Services under the Agreement. Customer Personal Data does not include Personal Data that Wiz Processes as a Controller separately from its Processing obligations to Customer under the Agreement.
- “Data Protection Laws” means all laws and regulations of the European Union, the EEA and their Member States, Switzerland, the United Kingdom, and United States, each to the extent applicable to the Processing of Personal Data under the Agreement.
- “Data Subject” means the identified or identifiable person to whom the Customer Personal Data relates.
- “EEA” means the European Economic Area.
- “EU Data Protection Law” means the GDPR, and the UK GDPR.
- “Extended EEA Country” means a country within the EEA, Switzerland or the United Kingdom, and Extended EEA Countries means the foregoing countries collectively.
- “Member State(s)” means a country that belongs to the European Union and/or the EEA.
- “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier.
- “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- “Processor” or “Service Provider,” as relevant under applicable Data Protection Laws, means the entity which Processes Personal Data on behalf of the Controller or Business or such equivalent term under Data Protection Laws.
- “Security Documentation” means Wiz’s security documentation that is applicable to the specific Services purchased by Customer, as updated from time to time, and as made reasonably available by Wiz.
- “Standard Contractual Clauses” means the “standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council adopted by the European Commission decision of 4 June 2021” and published under document number C (2021) 3972 available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en, as may be updated, amended or superseded from time to time.
- “Sub-Processor” means any Processor or Service Provider engaged by Wiz and/or Wiz Affiliate to Process Customer Personal Data.
- “Supervisory Authority” means the competent supervisory authority pursuant to the applicable Data Protection Laws.
- “Third Country” has the meaning given in Clause 8.2 below.
- “UK GDPR” means the GDPR as incorporated into United Kingdom domestic law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR").
- “U.S. Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 along with any associated regulations (“CCPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act; and any similar U.S. laws governing data privacy and security once effective.
- Wiz certifies that it understands its obligations in this Clause 9.
Table 1. The “start date” will be the date this DPA enters into force. The “Parties” are Customer or Customer Authorized Affiliate as exporter Wiz as importer.
Table 2. The “Addendum EU SCCs” are the modules and clauses of the Standard Contractual Clauses selected in relation to a particular transfer in accordance with paragraphs 1.1 and 1.2 of this Schedule.
Table 4. Neither party may end the UK Approved Addendum in accordance with its Section 19.
A. LIST OF THE PARTIES | |
Data Exporter: | Name and address: Customer or Customer Authorized Affiliate, as set out in the Agreement Contact details: As set out in the Agreement Activities relevant to the data transferred under these Clauses: Receipt of Wiz Services, as set out in the Agreement and this DPA |
Data Importer:	 | Name and address: Wiz, as set out in the Agreement Contact details: Privacy Officer, privacy@wiz.io Activities relevant to the data transferred under these Clauses: Provision of Wiz Services, as set out in the Agreement and this DPA |
B. DETAILS OF PROCESSING/TRANSFER | |
CATEGORIES OF DATA SUBJECTS | As described in Schedule 1 |
CATEGORIES OF PERSONAL DATA	 | As described in Schedule 1 |
SPECIAL CATEGORIES OF DATA (IF APPLICABLE) | Wiz does not control which Personal Data Customer shares with it in the context of the Services |
FREQUENCY OF THE TRANSFER | As regular as is required to provide the Services |
NATURE AND PURPOSE OF THE PROCESSING	 | As described in Schedule 1 |
RETENTION | As described in Schedule 1 |
TRANSFER TO (SUB)PROCESSORS | As set out in Wiz’s Sub-Processor List. |
C. COMPETENT SUPERVISORY AUTHORITY | |
The competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses. Where an EU Representative has not been appointed by data exporter, the competent supervisory authority shall be the supervisory authority of the Netherlands. Where the data exporter is established outside of the EU, but within an Extended EEA Country, the competent supervisory authority shall be the supervisory authority of the Extended EEA Country in which the Transferring Client Entity is established. Where the data exporter is established outside an Extended EEA Country and the personal data originates from an Extended EEA Country which is not in the EU, the supervisory authority shall be the supervisory authority of the Extended EEA Country from which the Personal Data originated. | |
D. GOVERNING LAW AND CHOICE OF FORUM | |
GOVERNING LAW | For the purposes of Clause 17 of the Standard Contractual Clauses the Parties select OPTION 1: a)	(a) where the data exporter is established in the EU or otherwise if the personal data originates from the EU, the Parties select the laws of the Netherlands; (b) where the data exporter is established outside the EU but within an Extended EEA Country, the Parties select the laws of the Extended EEA Country where the data exporter is established; or (c) subject to (a) above, where the data exporter is established outside an Extended EEA Country, the parties select the laws of the Extended EEA Country where the personal data originates from. |
CHOICE OF FORUM | For the purposes of Clause 18 of the SCCs:
outside an Extended EEA Country, the parties select the courts of the Extended EEA Country where the personal data originates from. |
E. OTHER | |
Where the Standard Contractual Clauses identify optional provisions (or provisions with multiple options) the following will apply:	 For Clause 7 (Docking Clause), the optional provision will apply. For Clause 9(a), option 2 will apply and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA. For Clause 11(a) (Redress) – the optional provision will not apply. |