Third Party Index

Snapshot 17102

Document
Privacy policy
URL
https://bigid.com/wp-content/uploads/2026/03/BigID-Privacy-Notice_03092026.pdf
Fetched
HTTP status
200
Content type
application/pdf
Fetch mode
pdf
Size
328694 bytes
SHA-256 (raw)
015277b6fb434f18c0289609e1f54c2a4f75db5165be5e4a7714549224356303
SHA-256 (normalized text)
b2c34d9338ef950ec15d95907d28c90f235914ebfb41a66b4cc0c07f370dd528

Normalized text

Scripts and page chrome removed; this is what change detection compares.

                                                                                                  Big ID Privacy Notice

                             BigID Privacy Notice
                                       Last Updated: March 9, 2026

INTRODUCTION

This Privacy Notice (or “Notice”) describes the information that BigID Inc., its subsidiaries, and its
affiliated companies (“BigID”, “our”, “we”, or “us”) may collect, use, and disclose about customers
or users (“you” or “your”) when you visit our websites www.bigid.com and university.bigid.com
(“Websites”); register for or attend our events, webinars, and newsletters; and/or register for a
demonstration or trial of our products.

BigID is committed to the responsible collection and use of your personal information under this
Notice, which includes any information that identifies, relates to, describes, is capable of being
associated with, or could reasonably be linked with an identified or identifiable individual. In simple
terms, personal information is any data that can be used to identify you, directly or indirectly. If an
applicable law describes personal information more broadly, we will apply that definition.

However, this Notice does not address any personal data included in documents, content,
intellectual property, or information that is input into the software or used in advisory services
(collectively, the “Services”) by you or on your behalf or that output from your use of the Services,
which we address in our software licensing agreements with customers.

If you have questions about anything in this Notice, please contact us at [email protected].

                                                                                                                1 of 21
                                                         Big ID Privacy Notice

  TABLE OF CONTENTS

 INTRODUCTION                                            1
 TABLE OF CONTENTS                                       2
   1. Personal Information Collected                     3
   2. Uses of Personal Information                       5
   3. Disclosure of Personal Information                 7
   4. Selling/Sharing Personal Information               9
   5. Retention of Personal Information                  9
   6. Safeguarding Personal Information                 10
   7. Managing Your Personal Information                10
   8. Use of BigID’s Service by Minors                  12
   9. International Transfers of Personal Information   12
 10.                                                         EU-US
 Data Privacy Framework Principles                      12
    11. Residents of the EEA, UK and Switzerland        14
 12.                                                         US Data
 Privacy Laws                                           15
 13.                                                         Updates to
 This Notice                                            18
 14.                                                         How to
 Contact Us                                             18
Exhibit A                                               19
   BigID’s Use of Information Technologies              19

                                                                       2 of 21
1. Personal Information Collected

                            Data Collected Directly from You

    Contact Details              We collect your contact details when you register for an event,
                                 inquire about or sign up for our Services, or download or sign up
                                 for our content (e.g., newsletters). This may include your name,
                                 email address, company name, job title, postal addresses, and
                                 phone number. We also keep a record of any correspondence
                                 that you send when you contact us through the Websites.

    Account Creation Data        When creating an account with us, we collect log in credentials
                                 as well as any contact information or other personal information
                                 you share. If you’re signing up for a service, your transactional
                                 data is also collected.

    Device Information           We may collect certain personal information related to your
                                 device when you visit our Websites, such as your device’s IP
                                 address, the referring website, the pages your device visited,
                                 and the time and date that your device visited our Websites.

    Preferences                  We may collect personal information on your preferences for
                                 receiving marketing communications and details about how you
                                 engage with us.

    Chatbot Data                 We may collect a log of your interactions with BigID’s chatbot.

    Administrative and Support   We may collect personal information about your use of and
    Data                         access to our Services, which may include administrative and
                                 support communications with us, third-party integrations you
                                 use (if any), and messages, persons, features, content, and
                                 links you interact with.

    Payment Information          We may collect payment-related information (such as billing
                                 address and payment method type) as needed to facilitate
                                 transactions. Full payment card details are processed by our
                                 third-party payment processorand are not stored by BigID. .

    Cookies and Similar          We use various technologies to collect information on our
    Technologies                 Websites and online services. For more information, see our

                                                                                                     3 of 21
                             Cookies and Similar Technologies Notice.

User Feedback                We may collect feedback data via the Services when you reach
                             out to our support teams, after a webinar or after interacting with
                             our Website or Products.

BigID University and BigID   When accessing BigID University or the BigID sandbox
On-Demand Lab Services       environments offered through our On-Demand Lab Services, we
Usage Data                   may collect certain personal information about your general
                             usage data, which may include but is not limited to website
                             clicks, learning history, mouse movements, and browser types.

Developer Community Data     When you participate in our Developer Community, BigID may
                             collect your contact information, including mailing address,
                             email address, photo, domain details, username, and other
                             similar information, as well as information about the individual’s
                             device.

Employment information       If you apply for an open position with BigID, we will collect
                             employment application information, such as your resume,
                             LinkedIn profile, cover letter, and online portfolio.

                     Data Collected From Other Sources

Online Sources               BigID may collect personal information from other sources,
                             including third-party platforms and online databases and
                             directories, as well as third parties from whom we have
                             purchased personal data.
                             We may combine this data with personal information we already
                             have about you to ensure such personal information maintained
                             by BigID is accurate and up to date.
                             BigID may also engage in joint marketing activities or event
                             sponsorships with third-party partners, and we may collect
                             personal information about you from these activities. We rely on
                             our partners to obtain your consent before sharing your
                             personal information with us.

                                                                                                   4 of 21
    Integrations              If a customer integrates a third-party service with the BigID
                              platform, BigID may receive certain information from the third-
                              party provider about the customer’s partnership with the third
                              party.

2. Uses of Personal Information
    Communicating with You    Communicating with You. BigID uses the personal information it
                              collects to
                              (1) communicate with you regarding our Services, including by
                                 sending you announcements, technical notices and updates,
                                 security alerts, and support and administrative messages,
                                 and
                              (2) to allow you to download white papers, inquire about our
                                 Services, and participate in our surveys, promotions or
                                 events. We use this information to provide you with the
                                 material(s) you requested, to follow up with you about your
                                 interest in the Services, and/or to register you for an event.
                                 Additionally, we may use personal information to understand
                                 your preferences in order to enhance your experience and
                                 send you information about BigID, such as upcoming
                                 promotions or events.

    Providing and Improving   BigID uses the personal information it collects to
    the Services.
                              (1) provide, operate, maintain, administer and improve the
                                 Services
                              (1) prevent or address issues in connection with support
                                 matters;
                              (2) respond to Services- and employment-related requests,
                                 questions, and feedback.

                                                                                                  5 of 21
Marketing and Advertising.   BigID may use the personal information it collects to manage
                             advertising, conduct market research and/or provide you with
                             offers or advertisements based on your browsing activities.
                             Using personal data obtained by third party sources helps us to
                             update, expand and analyze our records, identify new
                             customers, and create more tailored advertising to provide
                             products and services that may be of interest to you.
                             You have the right to opt out of any marketing or advertising
                             communications via the link ‘Your Privacy Choices’ in the footer
                             of www.bigid.com or via the opt out prompt in a marketing email.

Testimonials and User-       We may ask for your explicit consent to collect or use your
Generated Content            personal information to post a testimonial or endorsement of the
                             Services on our websites. Please be aware that whenever you
                             voluntarily disclose personal information online, the information
                             becomes public and can be collected and used by others. We
                             have no control over, and take no responsibility for, the use,
                             storage, or dissemination of such publicly disclosed personal
                             information. By posting personal information online in public
                             forums, you may receive unsolicited messages from other
                             parties.

Legal Bases for Processing   We collect and process personal information where there is a
                             legal basis to do so. There are four primary bases upon which
                             we rely when processing personal information:
                             (1) Contract: We process personal information to fulfill terms of
                                 a contract entered between BigID and its customers,
                                 vendors, and partners.
                             (2) Legitimate Interest: We have a legitimate interest in
                                 operating and improving the Services, protecting the security
                                 of personal information we process, supporting our
                                 customers, marketing and promoting our Services as
                                 otherwise necessary to protect BigID.
                             (3) Consent: Where a user provides consent, BigID uses their
                                 personal information for a specific purpose.

                             (4) Legal Obligation: We may be required to process a user’s
                                 personal information to comply with applicable law; to
                                 pursue, defend, and manage legal claims and disputes; to
                                 enforce our contracts; to ensure compliance with our legal
                                 and contractual obligations and our internal policies; and to
                                 respond to lawful requests from governmental authorities.

                                                                                                 6 of 21
    Use for New Purposes            If we need to use your personal information for a new purpose
                                    not described in this Notice, we will update this Notice and,
                                    where required by law, seek your consent before doing so.
                                    Where permitted by applicable law, we may use your personal
                                    information for compatible purposes that are closely related to
                                    the original purpose of collection.

    Managing the Websites           BigID uses the personal information it collects to manage the
                                    Websites, including by enhancing their functionality, maintaining
                                    user-selected preferences, and delivering relevant content to
                                    enrich your experience. This may involve analyzing aggregated
                                    usage data to identify trends, improve site navigation, and
                                    optimize performance. More information on how web trackers
                                    are managed on the Websites can be found in BigID's Cookies
                                    and Similar Technologies Notice and in Exhibit A of this Notice.

3. Disclosure of Personal Information
  BigID may disclose your personal information for the following (5) purposes:

    To Provide Services             We may share your personal information with our affiliates and
                                    service providers in order to administer and provide the
                                    Services on our behalf, and/or provide other services such as
                                    marketing, billing, data analysis, customer service, email
                                    delivery, auditing, etc. Certain service providers may use
                                    artificial intelligence (AI) tools in delivering services to BigID.
                                    These providers are contractually prohibited from using your
                                    personal information or BigID's data to train their AI models.
                                    Additional details regarding service providers' use of AI are
                                    outlined within individual agreements between BigID and our
                                    customers. These service providers are authorized to use your
                                    personal information only as necessary to provide the requested
                                    services to BigID.

    Marketing and Advertising       We may share personal information with third-party social
                                    networking programs, like LinkedIn, for marketing and
                                    advertising purposes.
                                    We may also share your data with our partners who co-sponsor
                                    events that you choose to attend. We may share or sell your
                                    personal information as described in Section 4. You may opt out
                                    through the portal in the footer of www.bigid.com labeled ‘Your
                                    Privacy Choices’ or by implementing the Global Privacy Control

                                                                                                          7 of 21
                       (“GPC”).

Third-Party Partners   When BigID discloses personal information to third parties for
                       the purposes of providing and operating the Services. For
                       example, our network of partners enables us to offer various
                       integrations that interconnect with third-party software and BigID
                       may, acting on our customer’s behalf, share personal
                       information with the provider of an integration selected by the
                       customer. BigID is not responsible for the acts and omissions of
                       such third parties, and such relationship is governed by the
                       contract signed between the customer and the partner. Note
                       that this Notice does not address, and BigID is not responsible
                       for, the privacy, information, or other practices of any third
                       parties, including any third party operating any site or service to
                       which the Websites link. The inclusion of a link on the Websites
                       does not imply endorsement of the linked site or service by us
                       or our affiliates.

                       When BigID discloses personal information to third parties
                       acting on our behalf (such as service providers and processors),
                       we remain accountable for ensuring that your personal
                       information is protected. We achieve this through the following
                       measures: (1) We enter into written agreements with all service
                       providers and processors that require them to process personal
                       information only in accordance with our instructions and
                       applicable data protection laws; (2) These agreements include
                       obligations regarding data security, confidentiality, sub-
                       processing restrictions, and data breach notification; (3) We
                       conduct due diligence on service providers before engagement
                       and periodically review their compliance with contractual and
                       legal requirements; and (4) Where required by applicable law,
                       we ensure appropriate transfer mechanisms are in place (such
                       as Standard Contractual Clauses or Data Privacy Framework
                       certification) before transferring personal information
                       internationally. If a third party processing personal information
                       on our behalf does so in a manner that is inconsistent with
                       applicable data protection laws, BigID may be held liable unless

                                                                                             8 of 21
                                       we can demonstrate that we are not responsible for the event
                                       giving rise to the violation.

    Compliance with Laws and           We may disclose information as necessary for the following
    Disputes                           reasons:
                                       (1) for security, compliance, fraud prevention, and safety
                                          purposes
                                       (2) as required by law, lawful requests, or legal process, such
                                          as to respondto subpoenas or requests from government
                                          authorities
                                       (3) where required by law in connection with any legal
                                          investigation
                                       (4) to take legal action or defend legal claims.

    Business Transfers and             If we engage in a merger, acquisition, bankruptcy, dissolution,
    Structure Changes                  financing, reorganization or a similar transaction or proceeding,
                                       some or all of BigID’s business records and/or assets containing
                                       personal information may be disclosed as part of that
                                       transaction or proceeding.

4. Selling/Sharing Personal Information
  BigID does not sell your personal information for money.

  Some laws define the “sale” of personal information broadly, and include disclosures of personal
  information for commercial activities, like targeting advertising, and may define “sharing” of
  personal information as providing it to advertising networks and other companies that facilitate
  digital advertising for purposes of cross-context behavioral advertising. Under that broader
  definition, in the past 12 months, BigID has sold and/or shared the following categories of personal
  information for cross-context behavioral advertising purposes: (i) identifiers, (ii) internet/electronic
  activity, (iii) commercial and/or financial information, (iv) professional and/or employment
  information, and (v) inferences/preferences.

  BigID does not knowingly sell or share the personal information of minors under the age of 16.

5. Retention of Personal Information
  We retain your personal information for the least amount of time necessary to fulfill the purposes
  for which it was collected, including for satisfying any legal, accounting, or reporting requirements.
  To determine the appropriate retention period for personal information, we consider its volume,
  nature, and sensitivity, the potential risk of harm from its unauthorized use or disclosure, the
  purposes for which we process your personal information and whether we can achieve those
  purposes through other means, and applicable legal requirements.

                                                                                                             9 of 21
6. Safeguarding Personal Information
  BigID maintains organizational, technical, and administrative security measures, including
  encryption in transit and at rest, access controls, employee training, and regular security
  assessments, designed to protect personal information. Please be advised that no security
  safeguards or standards are guaranteed. You should always use appropriate self-protection
  measures and practice safe browsing on all websites. For more information, the National
  Cybersecurity Alliance provides comprehensive information on how to stay safe online.

  7. Managing Your Personal Information
  Individuals in specific jurisdictions, including but not limited to the EEA, Switzerland, UK,
  California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New
  Jersey, Oregon, Texas, Utah, Virginia and Brazil, have certain rights to their personal information.
  This section describes those rights and how you can exercise them with BigID. This list may not
  be exhaustive; we honor applicable rights under all jurisdictions where we operate.

                                  Your Rights and Preferences

    Marketing Preferences            (1) You may opt out of certain marketing communications or
                                         withdraw previously provided consent for posted
                                         testimonials.
                                     (2) You may opt out of the sale or sharing of your personal
                                         information for targeted advertising through the portal in the
                                         footer of www.bigid.com labeled ‘Your Privacy Choices ’or by
                                         implementing the Global Privacy Control (“GPC”).

                                     (3) You can learn more about BigID’s use of information
                                         technologies with respect to our marketing efforts in Exhibit
                                         A.

    Right to View and Access         You have the right to know whether your personal information is
                                     being processed and how and with which third parties it’s being
                                     shared. You also have the right to request access to your
                                     personal information and request a copy of the personal
                                     information being processed.

    Right to Erasure                 You may request that we erase your personal information,
                                     subject to certain exceptions as set forth in applicable laws.

    Right to Rectification           You may request that we correct or rectify your personal
                                     information that is inaccurate.

                                                                                                          10 of 21
  Right to Restrict                You may request that we restrict processing of your personal
  Processing                       information.

  Right to Data Portability        You have the right to receive the personal information you
                                   provided us in a structured, industry-standard and machine-
                                   readable format and you have the right to transmit the personal
                                   information to a third-party of your choice.

  Right to Limit Use of            You have the right to limit our use and disclosure of your
  Sensitive Personal               sensitive personal information.
  Information

  Right to Object to               You have the right to object to our processing of your personal
  Processing                       information for direct marketing or on our reliance of legitimate
                                   interests as the basis of our processing of your personal
                                   information when you have specific grounds to object.

  Right to Opt Out of              You have the right not to be subject to a decision based solely
  Automated Decision               on automated processing, including profiling.
  Making

  Right Not to Receive             You have the right to not be discriminated against for exercising
  Discriminatory Treatment         your privacy rights.

The rights set forth in this section can be actioned either through the portal accessed through the ‘Your
Privacy Choices ’link at the footer of www.bigid.com, by emailing [email protected], or by mail sent to
our postal address below:

BigID, Inc.
379 W Broadway, Floor 2, New York,
NY 10012 Attention: Privacy Officer

We may request specific information from you to help us confirm your identity and process your request.
Applicable  law      may      require     or     permit     us     to     decline     your     request.

If we decline your request, you may appeal our decision by emailing [email protected] with the subject
line 'Privacy Rights Appeal.' We will respond to your appeal within 45 (or 60 days where required by
applicable law)days as required by applicable law. If your appeal is denied, you may file a complaint
with your state Attorney General or applicable regulatory authority.

                                                                                                       11 of 21
8. Use of BigID’s Service by Minors

  Our Websites and Services are intended for use by individuals who are 18 years old and older. BigID’s
  policy is to not seek to collect personal information on any person under the age of 18. If you inform us
  or we otherwise become aware that we have unintentionally received personal information from an
  individual under the age of 18, we will delete this information from our records.
9. International Transfers of Personal Information
  Your personal information may be transferred to countries outside your country of residence that
  may have different data protection standards. For transfers from the EEA, UK, or Switzerland, we
  rely on the EU-US Data Privacy Framework, Standard Contractual Clauses approved by the
  European Commission, or other legally recognized transfer mechanisms. For a copy of the
  relevant safeguards, please contact us at [email protected].
  10. EU-US DATA PRIVACY FRAMEWORK PRINCIPLES

    The Principles                  BigID complies with the EU-US Data Privacy Framework and,
                                    as applicable, the UK Extension to the EU-US DPF, and the
                                    Swiss-US Data Privacy Framework (“Swiss-US DPF”)
                                    (collectively, the “EU-US DPF” for purposes of this Notice) as
                                    set forth by the US Department of Commerce.

                                    BigID has certified to the US Department of Commerce that it
                                    adheres to the EU-US DPF Principles with regard to the
                                    processing of personal information received from the
                                    European Union in reliance on the EU-US DPF. BigID has
                                    also certified its adherence to the Swiss-US DPF Principles
                                    for personal information received from Switzerland in reliance
                                    on the Swiss-US DPF.

    Conflict                        If there is any conflict between the terms in this Notice and the
                                    EU-US DPF Principles, the EU-US DPF Principles shall
                                    govern. To learn more about the Data Privacy Framework
                                    program, and to view our certification, please visit:

                                    https://www.dataprivacyframework.gov/.

    Your Rights                     You are entitled to manage your rights as detailed in Section
                                    7. Further, pursuant to the EU-US DPF Principles, EU, UK,
                                    and Swiss residents have the right to obtain confirmation of
                                    whether BigID maintains your personal information in the
                                    United States.

                                                                                                         12 of 21
Inquiries and Complaints   Residents of the EU, UK, and Switzerland with inquiries or
                           complaints regarding BigID’s handling of personal information
                           received in reliance on the EU-US DPF should contact BigID
                           to discuss and resolve such inquiries and/or complaints. You
                           may contact BigID at [email protected] or at the following
                           address:
                           BigID Inc.
                           379 W Broadway, Floor 2 New York, NY 10012 Attention:
                           Privacy

                           Officer Email: [email protected]

Independent Recourse       Further, BigID has committed to refer unresolved privacy
Mechanism                  complaints under the EU-US DPF Principles to BBB National
                           Programs (“BBB”), a US-based independent dispute
                           resolution mechanism.

                           If you do not receive timely acknowledgment of your complaint
                           from BBB, or if your complaint is not satisfactorily addressed,
                           please visit www.bbbprograms.org/dpf-complaints for more
                           information and to file a complaint. This service is provided
                           free of charge to you.

Arbitration                If your EU-US DPF Principles-related complaint cannot be
                           resolved through the channels listed in this section, under
                           certain conditions, you may invoke binding arbitration for
                           residual claims not resolved by any of the other DPF redress
                           mechanisms. For additional information, please review Annex
                           1 to EU-US DPF.

Liability for Onward       BigID is responsible for the processing of personal information
Transfers                  we receive and then transfer to a third-party acting as an
                           agent on our behalf. We maintain contracts with our third-
                           party service providers to ensure they provide at least the
                           same level of protection as required by applicable data
                           protection laws. BigID potentially remains liable if our agent
                           processes personal information protected by the EU-US DPF
                           in a manner inconsistent with the Principles, unless we prove
                           we’re not responsible for the event(s) leading to the damage.

                                                                                             13 of 21
  US Federal Trade                  US Federal Trade Commission Enforcement. The US Federal
  Commission Enforcement            Trade Commission has jurisdiction over BigID’s compliance
                                    with the EU-US DPF.

11.    RESIDENTS OF THE EEA, UK AND SWITZERLAND
   EEA Representative                 UK Representative            Swiss Representative

  Under European data               Under UK data protection       Under Swiss data protection
  protection laws, and except       laws, and except when acting   laws, and except when acting
  when acting as a processor        as a processor on behalf of    as a processor on behalf of
  on behalf of our customers,       our customers, BigID is the    our customers, BigID is the
  BigID is the controller of your   controller of your personal    controller of your personal
  personal information covered      information covered by this    information covered by this
  by this Notice.                   Notice.                        Notice.

Our EU, UK and Swiss representative is Heather Kuhn located at 379 W Broadway, Floor 2 New
York, NY 10012 Attention: Privacy. This representative can be contacted at [email protected].

We only use your personal information where we have a legal basis to do so.

The following table describes the legal bases we rely upon to process your personal information.
If you have questions about the legal basis under which we process your personal information,
you may contact us at [email protected].

                                                        Legal Base Supporting the
      Purpose of Processing Data
                                                               Processing

  Providing and improving the Services              Performance of a contract; legitimate
                                                    interests

  Communicating with you                            Consent; performance of a contract

  Marketing and advertising                         Legitimate interests

                                                                                                   14 of 21
   Security, compliance, fraud prevention              Legitimate interests
   and safety reasons

   To establish a claim, exercise a legal
   action, or defend against legal claims
                                                       Legitimate interests

   To comply with applicable law                       Legal obligations

   When you provide consent (which is
   revocable at any time by emailing
                                                       Consent
   [email protected])

   Chatbot interactions                                Legitimate interests; consent (where
                                                       applicable)

   BigID University and On-Demand Lab                  Performance of a contract; legitimate
   Services                                            services

   Developer Community participation                   Consent; performance of a contract

   Processing employment applications                  Consent; steps necessary to enter into a
                                                       contract; legal obligation

If you are in the EEA, UK, or Switzerland you have the following rights related to your personal
information: (1) right to view and access, (2) right to erasure, (3) right to rectification, (4) right to
restrict processing, (5) right to data portability, (6) right to object to processing of your personal
information for direct marketing purposes and (7) the right to opt out of automated decision
making. These rights can be actioned either through the portal accessed through the ‘Your
Privacy Choices ’link at the footer of www.bigid.com or by emailing [email protected]. You have
the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual
residence, place of work, or place of the alleged infringement. A list of EEA data protection
authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the
UK, contact the ICO at https://ico.org.uk/make-a-complaint/. For Switzerland, contact the FDPIC
at https://www.edoeb.admin.ch/.

12. US DATA PRIVACY LAWS

We process personal information in accordance with applicable US state privacy laws. Several
state laws require additional information on the processing of residents ’personal information. The
below disclosure supplements the Notice.

                                                                                                            15 of 21
                          US Data Privacy Laws

Rights Available to You             Residents of states with privacy laws may
                                    have rights to manage their personal
                                    information, as outlined in Section 7.
                                    For example, California residents have the
                                    right to view, access, delete, and correct their
                                    personal information. They also have the right
                                    to opt out of the sale or sharing of their
                                    personal information, to limit the use and
                                    disclosure of their sensitive personal
                                    information, and to not receive discriminatory
                                    treatment by BigID for the exercise of their
                                    privacy rights.
                                    Please note that BigID does not collect
                                    sensitive personal information as defined
                                    under the CCPA/CPRA — such as Social
                                    Security numbers, financial account
                                    credentials with required security codes,
                                    precise geolocation, racial or ethnic origin,
                                    religious beliefs, union membership, contents
                                    of mail or email, genetic data, biometric data,
                                    health information, or information about sex life
                                    or sexual orientation — through its Websites or
                                    marketing activities, except where you
                                    voluntarily provide such information (for
                                    example, in an employment application). BigID
                                    does not use or disclose sensitive personal
                                    information except to provide you the Services
                                    or as otherwise permitted by applicable privacy
                                    law. You have the right to limit our use and
                                    disclosure of any sensitive personal
                                    information, as described below and in Section
                                    7.You or your authorized agent can submit a
                                    request to exercise your rights by visiting the
                                    portal in the footer of www.bigid.com labeled
                                    ‘Your Privacy Choices’ and following the
                                    prompts on the screen. Should you submit a
                                    request, BigID will verify your or your
                                    authorized agent’s identity.

                                                                                        16 of 21
Collection, Use, and Disclosure of Personal   For information on the types of personal
Information                                   information we collect, including the personal
                                              information we have collected from California
                                              residents in the last 12 months, the sources of
                                              that collected personal information, the
                                              purposes for collecting personal information,
                                              and the categories of third parties with whom
                                              we share that information, please refer to
                                              Sections 1, 2, and 3 on collection, use, and
                                              disclosure.

Data of Minors                                BigID does not seek to process personal
                                              information of individuals under the age of 18.

Retention                                     We only retain your personal information for as
                                              long as necessary to fulfill the purposes for
                                              which it was collected. To determine the
                                              appropriate retention period for personal
                                              information, we consider the volume, nature,
                                              and sensitivity of the personal information, the
                                              potential risk of harm from unauthorized use or
                                              disclosure of your personal information, the
                                              purposes for which we process your personal
                                              information and whether we can achieve those
                                              purposes through other means, and the
                                              applicable legal requirements.

California’s Shine the Light Law (Cal. Civ.   California residents may ask BigID to provide
Code § 1798.83)                               the names of third parties to whom we have
                                              disclosed personal information in the last 12
                                              months for direct marketing purposes and to
                                              identify the categories of personal information
                                              disclosed to them. You can request this
                                              information by emailing BigID at
                                              [email protected]. We may require additional
                                              information from you to verify your identity and
                                              California residency.

                                                                                                 17 of 21
   Submitting a Complaint                            We may request specific information from you
                                                     to help us confirm your identity and process
                                                     your request. Applicable law may require or
                                                     permit us to decline your request.
                                                     If we decline your request, we will provide you
                                                     with the reason for such determination, if
                                                     permitted by law.
                                                     You may appeal our decision by emailing
                                                     [email protected] with the subject line
                                                     'Privacy Rights Appeal.' We will respond to
                                                     your appeal within 45 days (or 60 days where
                                                     days as required by applicable law). If your
                                                     appeal is denied, you may file a complaint with
                                                     your state Attorney General or applicable
                                                     regulatory authority.

13.    UPDATES TO THIS NOTICE

We may periodically review and update this Notice as appropriate. Any changes or updates we
make will become effective once we post the revised Notice on the Websites. The date at the top
of the page indicates when this Notice was last revised.

We encourage you to please review this page regularly for the latest information on our privacy
practices. By visiting the Websites following these changes, you accept the revised Notice.

14.    HOW TO CONTACT US

If you have any questions or concerns about this Notice, please contact us via mail or email:

BigID Inc.
379 W Broadway, Floor 2 New York,
NY 10012 Attention: Privacy Officer
Email: [email protected]

                                                                                                       18 of 21
                                                Exhibit A

BigID’s Use of Information Technologies
  The following table describes various types of technologies BigID uses when a user or customer interacts
  with us online:

       Type of Technology                                Description of Use

    Cookies                             BigID uses a cookie consent tool, which allows a user to
                                        customize their cookie preferences. When you visit our
                                        Websites for the first time, a cookie consent banner will
                                        pop up and ask you to customize your cookie preferences.
                                        Please note that required cookies cannot be disabled and
                                        if you opt out of functional cookies, certain functionality of
                                        our Websites may be impacted. To learn more about the
                                        types of cookies we use please see our Cookies and
                                        Similar Technologies Notice.

    Global Privacy Control              The GPC is a technical specification that you can use to
    (“GPC”)                             inform websites of your privacy preferences regarding
                                        web trackers. To set up the GPC, you can visit the Global
                                        Privacy Control website. If you choose to set up GPC, we
                                        will automatically turn off all non-required cookies on
                                        BigID’s websites for you. Please note that this may impact
                                        the functionality of our Websites.

    Web Optimization Services           BigID shares data with Google Analytics to understand
                                        and optimize website performance and enhance site
                                        usability. Google Analytics runs in the background of
                                        www.bigid.com, analyzing site usage information and then
                                        returning reports to us through an encrypted connection.
                                        These services are required to maintain data securely and
                                        confidentially. If you would like to opt out of Google
                                        Analytics on a per browser basis, you can Click Here to
                                        download the Google Analytics opt out browser add-on.
                                        For more information on Google Analytics, click here.

                                                                                                         19 of 21
Social Media Widgets     Our Services may include social media features, such as
                         the Facebook “like” button, and widgets, such as the
                         “share this” button. These features may collect your
                         information and track your use of the Services.
                         These social media features are either hosted by a third
                         party or hosted directly in the Services.
                         Your interactions with these features are governed by the
                         privacy notice of the company providing such functionality.
                         You can manage your preferences for many of these
                         advertising programs directly through the links provided
                         below:

                               • Facebook

                               • Instagram

                               • LinkedIn

Social Network and New   BigID has relationships with several social networks and
Technology Advertising   new technology companies. These companies have
Programs                 specific interest-based advertising programs that match
                         people who have shown interest in BigID through our
                         Websites or other services with their platforms (such as
                         LinkedIn features). This matching allows us to deliver
                         relevant, interest-based advertisements on those
                         companies ’networks. You can manage your preferences
                         for many of these advertising programs through the links
                         provided below:

                               • Google

                               • LinkedIn

                               • StackAdapt

                               • 6Sense

Do Not Track             BigID does not respond to browser-based Do Not Track
                         (DNT) signals, as there is no industry-standard protocol
                         for DNT. However, BigID does honor the Global Privacy
                         Control (GPC) signal as described above.

                         You can manage your preferences for tracking across
                         sites in the table above. For more information on Do Not
                         Track please visit https://allaboutdnt.com/.

                                                                                       20 of 21
21 of 21