Snapshot 1920
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Error
Contracts
Data Processing Agreement
Data Privacy FAQ
Avalara Europe Ltd. Services Data Processing Agreement
Avalara, Inc. Services Data Processing Agreement
California Consumer Privacy Act Disclosures
EEA and United Kingdom Job Candidate Privacy Notice
India Job Candidate Privacy Notice
EEA & United Kingdom Privacy Notice
Subprocessors
United States Job Candidate Privacy Notice
Política de Cookies
Política de Privacidade da Avalara do Brasil
Australia Privacy Notice
India Privacy Policy
Brasil Job Candidate Privacy Notice
EEA & United Kingdom Privacy Notice IT Version
EEA & United Kingdom Privacy Notice ES Version
EEA & United Kingdom Privacy Notice DE Version
EEA & United Kingdom Privacy Notice FR Version
US Privacy Notice
Data Processing Agreement
Version
Effective June 2nd 2025
Download
Table of Contents
The Data Processing Agreement ("DPA") in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our Data Privacy FAQ.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Avalara, Inc.
Avalara, Inc. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement ("DPA") in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our Data Privacy FAQ.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Avalara, Inc.
Avalara, Inc. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement ("DPA") in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our Data Privacy FAQ.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Avalara, Inc.
Avalara, Inc. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement ("DPA") in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our Data Privacy FAQ.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Avalara, Inc.
Avalara, Inc. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement (DPA) in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our Data Privacy FAQ.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Avalara, Inc.
Avalara, Inc. Services Data Processing Agreement
To get a signed version, click Generate Signed Copy.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement (DPA) in place between the Avalara contracting entity listed below and the Customer is incorporated into the Agreement and is available on this page. To obtain a signed copy, use the launch form link. Once completed, you can download the signed DPA for your records.
For additional information, see our FAQs.
Return to the Avalara Legal Center homepage for more legal information.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed version here.
Effective May 23rd 2025 to June 2nd 2025
Download
Table of Contents
The Data Processing Agreement in place between the Avalara contracting entity below and Customer is available below and is incorporated into the Agreement between the Avalara contracting entity below and Customer. The link below opens a launch form that will generate a signed copy of the DPA, which you can then download and keep for your records. FAQs are available here.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed version here.
Effective September 19th 2024 to May 23rd 2025
Download
Table of Contents
The Data Processing Agreement in place between the Avalara contracting entity below and Customer is available below and is incorporated into the Agreement between the Avalara contracting entity below and Customer. Customer may download a signed DPA at the link below. FAQs are available here.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed version here.
Effective November 15th 2023 to September 19th 2024
Download
Table of Contents
The Data Processing Agreement in place between the Avalara contracting entity below and Customer is available below and is incorporated into the Agreement between the Avalara contracting entity below and Customer. Customer may download a signed DPA at the link below. FAQs are available here.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed version here.
Effective November 1st 2023 to November 15th 2023
Download
Table of Contents
The Data Processing Agreement in place between the Avalara contracting entity below and Customer is available below and is incorporated into the Agreement between the Avalara contracting entity below and Customer. Customer may download a signed DPA at the link below. FAQs are available here.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed version here.
Effective October 26th 2023 to November 1st 2023
Download
Table of Contents
The Data Processing Agreement in place between the Avalara contracting entity below and Customer is available below and is incorporated into the Agreement between the Avalara contracting entity below and Customer. Customer may download a signed DPA at the link below. FAQs are available here.
Avalara Contracting Entity
DPA
Avalara Europe Ltd.
Avalara Europe Ltd. Data Processing Agreement
*Executed Version here.
Avalara, Inc.
Avalara, Inc. Data Processing Agreement
*Executed Version here.
Data Privacy FAQ
Version
Effective October 15th 2024
Download
Table of Contents
Introduction
Avalara has prepared these Frequently Asked Questions (“FAQs”) to assist customers in understanding their obligations and Avalara’s obligations under privacy laws and regulations.
The FAQs do not, and are not intended to, constitute legal advice. All information, content, and materials available below are for general informational purposes only and do not form part of the agreement.
Why does Avalara make available a data processing agreement?
As part of Avalara main terms, Avalara offers a Services Data Processing Agreement (“DPA”) which provides helpful contractual terms for the processing of personal data. Avalara has customers around the globe and the DPA incorporates the core privacy principles that inform many international data protection laws.
What is Avalara’s role?
In relation to the provision of the services, Avalara acts as a data processor for the personal data that our customers submit. Therefore, Avalara processes personal data on behalf of and according to our customers’ instructions who are the data controllers.
How does Avalara perform onward data transfers?
In order to provide its service, Avalara may use subprocessors (both Avalara affiliates and third parties) located outside the European Economic Area ("EEA"), the United Kingdom, and Switzerland.
Avalara uses the following data transfer mechanisms to transfer personal data outside of the EEA, the United Kingdom, and Switzerland:
1) Adequacy Status
The EEA recognizes certain countries around the world as offering an adequate level of protection for personal data. That means when Avalara transfers personal data to such countries, no further measures are required.
2) Standard Contractual Clauses
The European Commission’s Standard Contractual Clauses (as updated by the Commission Implementing Decision EU 2021/914 of 4 June 2021) (“SCCs”) are model contract clauses developed by the European Commission to legitimize transfers of personal data from the European Economic Area to processors located in other countries.
The UK has indicated that Standard Contractual Clauses can also be used as a safeguard to legitimatize transfers of personal data from the UK to processors located in other countries and our DPA is updated with the addendum to the SCCs which came into force on 21 March 2022.
Avalara also relies on the SCCs, for the purpose of intra-group transfer of personal data. Avalara Europe Ltd. transfers personal data to Avalara Inc. as data importer and subprocessor under Avalara’s internal Data Transfer Agreement (which includes the SCCs). As the customers are the data controllers and Avalara Europe Ltd. is the data exporter, customers are not transferring personal data outside the EEA; only Avalara Europe Ltd. does so as a data processor and data exporter pursuant to the Data Transfer Agreement.
How to execute this DPA
This DPA has been pre-signed on behalf of Avalara, Inc. (“Avalara, Inc. Services Data Processing Agreement”)
and Avalara Europe Ltd. (“Avalara Europe Ltd. Services Data Processing Agreement”)
For the Avalara, Inc. Services Data Processing Agreement: please insert relevant details under page 3, fill in details under Exhibit 1 Annex 1 List of Parties and sign.
For the Avalara Europe Ltd. Services Data Processing Agreement: please insert relevant details under page 2 and sign.
For the avoidance of doubt, signature of the Avalara Inc. DPA on page 3 shall be deemed to constitute signature and acceptance of the Standard Contractual Clauses, including Schedule 2.
Effective October 26th 2023 to December 31st 2024
Download
Table of Contents
Introduction
Avalara has prepared these Frequently Asked Questions (“FAQs”) to assist customers in understanding their obligations and Avalara’s obligations under privacy laws and regulations.
The FAQs do not, and are not intended to, constitute legal advice. All information, content, and materials available below are for general informational purposes only and do not form part of the agreement.
Why does Avalara make available a data processing agreement?
As part of Avalara main terms, Avalara offers a Services Data Processing Agreement (“DPA”) which provides helpful contractual terms for the processing of personal data. Avalara has customers around the globe and the DPA incorporates the core privacy principles that inform many international data protection laws.
What is Avalara’s role?
In relation to the provision of the services, Avalara acts as a data processor for the personal data that our customers submit. Therefore, Avalara processes personal data on behalf of and according to our customers’ instructions who are the data controllers.
How does Avalara perform onward data transfers?
In order to provide its service, Avalara may use subprocessors (both Avalara affiliates and third parties) located outside the European Economic Area ("EEA"), the United Kingdom, and Switzerland.
Avalara uses the following data transfer mechanisms to transfer personal data outside of the EEA, the United Kingdom, and Switzerland:
1) Adequacy Status
The EEA recognizes certain countries around the world as offering an adequate level of protection for personal data. That means when Avalara transfers personal data to such countries, no further measures are required.
2) Standard Contractual Clauses
The European Commission’s Standard Contractual Clauses (as updated by the Commission Implementing Decision EU 2021/914 of 4 June 2021) (“SCCs”) are model contract clauses developed by the European Commission to legitimize transfers of personal data from the European Economic Area to processors located in other countries.
The UK has indicated that Standard Contractual Clauses can also be used as a safeguard to legitimatize transfers of personal data from the UK to processors located in other countries and our DPA is updated with the addendum to the SCCs which came into force on 21 March 2022.
Avalara also relies on the SCCs, for the purpose of intra-group transfer of personal data. Avalara Europe Ltd. transfers personal data to Avalara Inc. as data importer and subprocessor under the Avalara’s internal Data Transfer Agreement (which includes the SCCs). As the customers are the data controllers and Avalara Europe Ltd. is the data exporter, customers are not transferring personal data outside the EEA; only Avalara Europe Ltd. does so as a data processor and data exporter pursuant to the Data Transfer Agreement.
How to execute this DPA
This DPA has been pre-signed on behalf of Avalara, Inc. (“Avalara, Inc. Services Data Processing Agreement”)
and Avalara Europe Ltd. (“Avalara Europe Ltd. Services Data Processing Agreement”)
For the Avalara, Inc. Services Data Processing Agreement: please insert relevant details under page 3, fill in details under Exhibit 1 Annex 1 List of Parties and sign.
For the Avalara Europe Ltd. Services Data Processing Agreement: please insert relevant details under page 2 and sign.
For the avoidance of doubt, signature of the Avalara Inc. DPA on page 3 shall be deemed to constitute signature and acceptance of the Standard Contractual Clauses, including Schedule 2.
Avalara Europe Ltd. Services Data Processing Agreement
Version
Effective June 3rd 2025
Download
Table of Contents
This Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (Security). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data
Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA .
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation ("GDPR") or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA here or at https://ironcladapp.com/public-launch/6819960f37abeffd1b5bf505. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
Exhibit 1
SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Return to the Avalara Legal Center homepage for more legal information.
Effective June 2nd 2025 to June 3rd 2025
Download
Table of Contents
This Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (Security). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data
Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA .
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation ("GDPR") or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA here or at https://ironcladapp.com/public-launch/6819960f37abeffd1b5bf505. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
Exhibit 1
SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Return to the Avalara Legal Center homepage for more legal information.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
This Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (Security). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data
Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA .
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation ("GDPR") or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA here or at https://ironcladapp.com/public-launch/6819960f37abeffd1b5bf505. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
Exhibit 1
SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Return to the Avalara Legal Center homepage for more legal information.
Effective November 15th 2023 to June 2nd 2025
Download
Table of Contents
This Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (Security). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data
Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA .
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA here or at https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhCV_CIBj5a1as7z3LRaE7FGGqhHIxcUIjcIf_NosDnnyU3iUwU0Zt1GwhoPnVcBSuQ*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
Exhibit 1
SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Effective November 1st 2023 to November 15th 2023
Download
Table of Contents
This Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (“Security”). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara, (b) make available to Customer all information necessary to demonstrate compliance with any mandatory privacy laws imposed on Customer or to conduct or document data protection assessments required by such laws, and (c) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data
Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers under the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
(c) takes all measures required pursuant to Article 32 of the GDPR (security of processing);
(d) respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA here or at https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhCV_CIBj5a1as7z3LRaE7FGGqhHIxcUIjcIf_NosDnnyU3iUwU0Zt1GwhoPnVcBSuQ*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
Exhibit 1
SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Effective October 26th 2023 to November 1st 2023
Download
Table of Contents
Last updated August 8, 2022
This DPA is incorporated into the Contract between Avalara Europe Ltd. (“Avalara” or “us” or “our”) and Customer. If a provision of this Avalara Europe Ltd. Services Data Processing Agreement (“DPA”) conflicts with a provision of the Contract, the provision in this DPA governs. Capitalised terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organisations (“Customer”) and protects Services Data in compliance with the terms of this DPA. Services Data means personal data relating to named or identifiable individuals that Customer’s authorised users (“Authorised Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
1. Control and Ownership. Customer owns and controls all Services Data. Avalara does not use Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated.
2. Security. Avalara applies technical, administrative and organisational data security measures that meet or exceed the requirements described in Exhibit 1 (“Security”). Avalara may update and modify Exhibit 1 from time to time, provided that Avalara must not reduce the level of security provided thereunder, except with Customer’s consent or with 90 days prior written notice.
3. Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara, and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
4. Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers.
5. Notify Breaches. Avalara notifies Customer of unauthorised access to Services Data and other security breaches as required by applicable law.
6. No Information Selling or Sharing for Cross‐Context Behavioral Advertising. Avalara does not accept or disclose any Services Data as consideration for any payments, services, or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers under the CCPA.
7. Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other countries as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara
(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
(c) takes all measures required pursuant to Article 32 of the GDPR (security of processing);
(d) respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
8. Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhB05c1e2iTcpxkELW8vTvPqk4U8ZyPEAzxTu9ldh7un3AHSdm8-TmV9ovhX8SMAjac. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
9. Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara Europe Ltd.
Lanchester House
3rd Floor
Trafalgar Place
Brighton BN1 4FU
United Kingdom
EXHIBIT 1: SECURITY
Avalara maintains the following technical and organisation measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorised access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyse, prioritise, and handle cyber security events and incidents to prevent, detect, and deter the unauthorised access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorised individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organisation's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Avalara, Inc. Services Data Processing Agreement
Version
Effective June 2nd 2025
Download
Table of Contents
This Avalara, Inc. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data.
Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instructs Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://ironcladapp.com/public-launch/6819960f37abeffd1b5bf505. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 100
512 S Mangum St.
Durham, NC 27701, USA
Exhibit 1
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
Return to the Avalara Legal Center homepage for more legal information.
Effective June 2nd 2025 to June 2nd 2025
Download
Table of Contents
This Avalara, Inc. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data.
Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instructs Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://ironcladapp.com/public-launch/6819960f37abeffd1b5bf505. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 100
512 S Mangum St.
Durham, NC 27701, USA
Exhibit 1
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
Return to the Avalara Legal Center homepage for more legal information.
Effective October 15th 2024 to June 2nd 2025
Download
Table of Contents
This Avalara, Inc. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data.
Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instructs Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhDjdoPrd_VbexJ4FZiqWiIRPUfxmjUSdJ4zZrK0UtHVNV_5dy9HD28JAMepyhq1bw8*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 100
512 S Mangum St.
Durham, NC 27701, USA
Exhibit 1
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
Effective November 15th 2023 to October 15th 2024
Download
Table of Contents
This Avalara, Inc. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data.
Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this Section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instruct Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhDjdoPrd_VbexJ4FZiqWiIRPUfxmjUSdJ4zZrK0UtHVNV_5dy9HD28JAMepyhq1bw8*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 1800
255 South King Street
Seattle, WA 98104, USA
Exhibit 1
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
Effective November 1st 2023 to November 15th 2023
Download
Table of Contents
This Avalara, Inc. Services Data Processing Agreement (“DPA”) is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this DPA conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. “Services Data” means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
Control and Ownership. Customer owns and controls all Services Data. Services Data is disclosed by Customer to Avalara only for the limited and specified business purposes of assisting Customer in complying with tax and financial obligations. Avalara does not use, retain, or disclose Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara shall not materially reduce the level of security provided thereunder, except with Customer’s consent.
Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara, (b) make available to Customer all information necessary to demonstrate compliance with any mandatory privacy laws imposed on Customer or to conduct or document data protection assessments required by such laws, and (c) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers. This includes a right for Customer to take reasonable and appropriate steps to help ensure that Avalara uses the Services Data in a manner consistent with Customer's legal obligations and the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Services Data.
Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
No Information Selling or Sharing for Cross‐Context Behavioral Advertising; Compliance with the CCPA. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers or contractors under the CCPA. Avalara will comply with the obligations on service providers under the CCPA and provide the same level of privacy protections required of Customer under the CCPA. If Avalara determines it can no longer meet its obligations under the CCPA or its implementing regulations, it will notify Customer. Avalara understands the restrictions in this section 6 and certifies it will comply with the same. If Avalara receives deidentified Services Data, Avalara will not attempt to reidentify the information except as permitted by the CCPA.
Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other jurisdictions as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
takes all measures required pursuant to Article 32 of the GDPR (security of processing);
respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instruct Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhDjdoPrd_VbexJ4FZiqWiIRPUfxmjUSdJ4zZrK0UtHVNV_5dy9HD28JAMepyhq1bw8*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 1800
255 South King Street
Seattle, WA 98104, USA
Exhibit 1
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
Effective October 26th 2023 to November 1st 2023
Download
Table of Contents
Last updated February 14, 2023
This DPA is incorporated into the Contract between Avalara, Inc. (“Avalara” or “us” or “our”) and Customer. If a provision of this Avalara, Inc. Services Data Processing Agreement (“DPA”) conflicts with a provision of the Contract, the provision in this DPA governs. Capitalized terms used and not otherwise defined in this DPA have the meanings provided in the Contract.
Except as amended by this DPA, the Contract will remain in full force and effect.
To the extent that the terms of this DPA and the Contract conflict, the terms of this DPA prevail.
This DPA will automatically expire on the termination or expiration of the Contract.
Avalara serves enterprises, public sector entities and other organizations (“Customer”) and protects Services Data in compliance with the terms of this DPA. Services Data means personal data relating to named or identifiable individuals that Customer’s authorized users (“Authorized Users”) provide in compliance with applicable law and our applicable service agreements or other commercial contract terms (“Contract”) when Customer uses our service offerings and related data processing services as described in our data sheets, service specifications, and other technical documentation, as amended from time to time (“Services”).
1. Control and Ownership. Customer owns and controls all Services Data. Avalara does not use Services Data, except: (a) in the interest and on behalf of Customer; (b) as necessary to provide the Services, or (c) as contemplated or directed by the Contract. Avalara returns or deletes Services Data at Customer’s request, as agreed in the Contract, or after the Contract expires or is terminated, subject to applicable law.
2. Security. Avalara applies technical, administrative and organizational data security measures that meet or exceed the requirements described in Avalara’s Technical and Organisational Measures in Exhibit 1, Annex II (“TOMs”). Avalara may update and modify its TOMs from time to time, provided that Avalara must not reduce the level of security provided thereunder, except with Customer’s consent or with 90 days prior written notice.
3. Cooperation with Compliance Obligations. At Customer’s reasonable request, Avalara will (a) reasonably assist Customer with data access, deletion, portability and other requests, subject to compensation for any custom efforts required of Avalara, and (b) enter into additional contractual agreements to meet specific requirements that are imposed by mandatory laws on Customer pertaining to Services Data and that, due to their nature, can only be satisfied by Avalara in its role as service provider or that Customer specifically explains and assigns to Avalara in an addendum or amendment to the applicable Contract, subject to additional cost reimbursement or fees as appropriate. If Customer can no longer legally use Avalara’s products due to changes in law or technology, Avalara shall allow Customer to terminate certain or all contracts and provide transition or migration assistance as reasonably required, subject to termination charges and fees as mutually agreed in good faith by the parties.
4. Submit to Audits. Avalara submits to reasonable data security and privacy compliance audits subject to reasonable precautions and safeguards for the data of other customers.
5. Notify Breaches. Avalara notifies Customer of unauthorized access to Services Data and other security breaches as required by applicable law.
6. No Information Selling or Sharing for Cross‐Context Behavioral Advertising. Avalara does not accept or disclose any Services Data as consideration for any payments, services or other items of value. Avalara does not sell or share any Services Data, as the terms “sell” and “share” are defined in the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act (“CCPA”). Avalara processes Services Data only for the business purposes specified in the written Contract. Avalara does not retain, use, or disclose Services Data (a) for cross‐context behavioral advertising, or (b) outside the direct business relationship with the Customer. Avalara does not combine Services Data with other data if and to the extent this would be inconsistent with limitations on service providers under the CCPA.
7. Personal Data subject to the GDPR or similar laws: With respect to any Services Data that is subject to the EU General Data Protection Regulation (GDPR) or similar laws of other countries as "personal data," Avalara accepts the following obligations as a data importer, processor or sub-processor of Customer and warrants that Avalara:
(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by European Union or EU Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; also, the processor shall immediately inform the controller if, in its opinion, an instruction infringes the GDPR, national data protection laws in the EU or other applicable law;
(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
(c) takes all measures required pursuant to Article 32 of the GDPR (security of processing);
(d) respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor;
(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, including, without limitation, right to access, rectification, erasure and portability of the data subject's personal data; (for the avoidance of doubt, processor shall only assist and enable controller to meet controller’s obligations to satisfy data subjects' rights, but processor shall not respond directly to data subjects)
(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of personal data) taking into account the nature of processing and the information available to the processor;
(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
8. EU Standard Contractual Clauses: For Services Data that is subject to the GDPR, Avalara complies with the EU Standard Contractual Clauses for international transfers in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (EU SCCs) for the transfer of personal data outside the European Economic Area (EEA), Modules 1-3 as noted below, in Exhibit 1. Under such EU SCCs, Customer will act as data exporter. Customer may be based within or outside the EEA. Customer may receive personal data from the EEA as a controller and as a processor under separate agreements. Avalara is based outside the EEA, acts as data importer, provides services to data exporter under separate commercial agreement(s) and agrees to the EU SCCs as a processor or sub-processor under Modules 2 and 3. Data exporter will provide all relevant instructions under Module 2 (as the controller) and under Module 3 (on the controller’s behalf). Customer instruct Avalara to provide Avalara’s standard services as described in Avalara’s commercial terms and service descriptions. For limited business contact information concerning individual representatives who provide instructions to Avalara, Avalara agrees to the EU SCCs as a controller under Module 1.
9. Switzerland: For transfers of Services Data from Switzerland, Avalara agrees to the EU SCCs as set out in Section 8 subject to the following amendments: The Federal Data Protection and Information Commissioner is the competent supervisory authority in so far as the data transfer falls under Swiss law. Switzerland is also to be considered as a Member State within the meaning of the EU SCCs so that data subjects can file claims according to clause 18c of the EU SCCs at their habitual residence in Switzerland. Until the revised Swiss Federal Act on Data Protection enters into force that does no longer protect data of legal persons but only data of natural persons, the EU SCCs also applies to data of legal persons.
10. United Kingdom: With respect to transfers of Services Data from the United Kingdom of Great Britain and Northern Ireland to countries not deemed to have adequate data protection regimes under all laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the United Kingdom of Great Britain and Northern Ireland, Avalara agrees to the EU SCCs as set out in Section 8 and the International Data Transfer Addendum to the EU SCCs in Exhibit 2. Any conflicts between the EU SCCs and the International Data Transfer Addendum to the EU SCCs shall be resolved as provided in the International Data Transfer Addendum to the EU SCCs.
11. Integration. This DPA is binding after a Contract has been signed between Avalara and Customer, and Customer may collect a signed copy of this DPA at here or https://avalara.na1.echosign.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhD8qGCX455w96VKreWqVy5W0RbQ_E1XtKdKuZpn1hVkh8z3XJDKKePI-McnHEXenqA*. This DPA shall not create third party beneficiary rights. Avalara does not accept or submit to additional requirements relating to Services Data, except as specifically and expressly agreed in writing with explicit reference to the Contract and this DPA.
12. Notice. Avalara shall provide Customer with legal notices in writing by email, mail, or courier to the address provided by Customer. Except as otherwise specified in the Agreement, all notices to Avalara must be in writing and sent as follows:
Email: DataPrivacy@avalara.com
Attn: Legal Department
Avalara, Inc.
Suite 1800
255 South King Street
Seattle, WA 98104, USA
EXHIBIT 1:
STANDARD CONTRACTUAL CLAUSES
The EU SCCs, modules 1-3, available at Standard Contractual Clauses (SCC) | European Commission (europa.eu) or on a successor website designated by the EU commission, are incorporated herein by reference. Customer will provide all instructions under these EU SCCs as the controller and on the controller’s behalf.
Where the EU SCCs require that the parties make an election, the parties make the elections reflected below. Any optional clauses in the EU SCCs not expressly selected below are omitted from this DPA.
for purposes of Clause 9 of the EU SCCs, Option 2 (‘General authorization’) shall apply and Avalara shall inform customer in writing of any intended changes to sub-processors at least 30 days in advance;
in Clause 11 (a) of the EU SCCs, the optional language shall be deleted; and
for purposes of Clause 17 and Clause 18 of the EU SCCs, the Member State for purposes of governing law, forum and jurisdiction shall be Luxembourg.
Annex I
A. LIST OF PARTIES
For purposes of Annex 1.A (List of Parties) of the EU SCCs: (i) Avalara processes personal data to provide Services to Customer and Avalara shall be the ‘data importer’; and (ii) Customer shall be the ‘data exporter’. Avalara can be contacted through the Avalara Global Privacy Office at dataprivacy@avalara.com. Customer provides personal data to Avalara to obtain Avalara’s Services and can be contacted through the contact information provided by Customer to Avalara.
B. DESCRIPTION OF TRANSFER
For the details of the processing of personal data required for Annex 1.B of the EU SCCs, see below:
MODULE ONE: Transfer controller to controller
Categories of data subjects whose personal data is transferred
Individual employees and representatives of data exporter who instruct data importer, send purchase orders, process invoices, arrange for payment, make support calls, use data importer's services, and otherwise do business with data importer.
Categories of personal data transferred
Business contact information, service usage, payment status and other information relating to how data exporter uses data importer's services.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
Sensitive data is not transferred on a controller-to-controller basis.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Data importer uses data as a controller to do business with data exporter, sell services, issue invoices, provide technical support, perform services, address customer questions, improve services and develop new services and offerings.
Purpose(s) of the data transfer and further processing
Communications and business collaboration between data exporter and data importer.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the term of the contract and so long as data importer markets additional services to data exporter.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Same as above.
MODULE TWO AND THREE: Transfer controller and processor to processor
Categories
Tax Calculation
Return Preparation
Tax Identification Registration
Fiscal Representation
Document Management
Categories of data subjects whose personal data is transferred
Customer’s customers
Customer if it is a sole traders/proprietor using personal contact information for its business; Customer’s Authorized Users
Customer’s owners and directors
Customer’s owners and directors
Customer’s contact details; Customer’s customers
Categories of personal data transferred
Delivery addresses, tax identifiers for sole traders/proprietorships, names, access credentials
Tax identifier for sole traders/proprietorship, names and contact details, access credentials for Authorized Users
Names and contact details of owners and directors as required by regulatory authorities, including proof of identification and date of birth
Names and contact details, proof of identification, tax identifiers for sole traders/proprietorships
Names and contact details, tax identifiers for sole traders/proprietorships
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
None
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
Passport images, which could include racial, ethnic, or religious information; access to data is subject to roles-based access controls
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous as initiated by customer in each case as part of each tax or regulatory audit period during which customer contracts for Avalara’s Services.
Nature of the processing
Calculating various types of tax
Preparing and filing tax returns
Registering Customer to collect and remit various tax types
Providing Fiscal Representation services
Using and managing tax related documents
Purpose(s) of the data transfer and further processing
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax obligations
Assist Customer in complying with tax and financial obligations
Assist Customer in complying with tax obligations
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Unless deletion is requested by the controller, the data will be processed until the end of applicable tax or regulatory audit periods.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Processor uses subprocessors for certain hosting, support, logging, monitoring, warehousing, infrastructure, and analytics purposes
C. COMPETENT SUPERVISORY AUTHORITY
For purposes of Clause 13 and Annex 1.C of the EU SCCs, where no competent supervisory authority is identified through the rules of such Clause 13, the competent supervisory authority is the authority in Luxembourg.
Annex II
TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
For the purposes of Annex 2 of the EU SCCs, the technical and organizational measures implemented by Avalara are as described below.
Avalara maintains the following technical and organization measures:
Avalara maintains a written security program under which Avalara periodically evaluates risks to Customer Data and maintains commercially reasonable technical, and physical safeguards to protect Customer Data against accidental or unauthorized access, disclosure, loss, destruction, or alteration. Avalara regularly evaluates the scope and coverage of the Security Program.
Avalara teams classify and handle data using technical controls described below to ensure its integrity, availability, and confidentiality.
Avalara maintains a central inventory of assets where the asset custodian is responsible for classifying and maintaining the asset and ensuring the use of the asset complies with the security program.
Avalara maintains standards for user authentication, access provisioning, de-provisioning, performing periodic access reviews and restricting administrative access to ensure access is granted based on the principle of least privilege.
Avalara maintains standards for segregation of network services and devices to ensure unrelated portions of the network are isolated from each other.
Avalara maintains network zones and applies ingress and egress standards for the protection of data.
Avalara systems encrypt data at rest and in transit between the Avalara networks and its customers to ensure integrity, security, and confidentiality of customer data.
Avalara maintains processes to securely generate, store and manage encryption keys that prevent loss, theft, or compromise.
Avalara maintains physical access controls to restrict entry to Avalara facilities. Physical controls may include badge readers, security personnel, staff supervision, video cameras, and other tools.
Avalara maintains processes for retaining and securely deleting data no longer than necessary to provide its services.
Direct database access is restricted using the corporate VPN. This can only be accessed via Avalara issued computing equipment.
Avalara has disabled the ability to write data to USB mass storage devices on all Avalara issued computing equipment.
Avalara maintains a Software Management Standard that defines software and services which are approved, acceptable, or prohibited to be used by Avalara personnel.
Avalara monitors its applications and systems for vulnerabilities on a periodic basis. Identified vulnerabilities are remediated by taking actions to close them in a timely manner.
Avalara maintains an incident response program to detect, analyze, prioritize, and handle cyber security events and incidents to prevent, detect, and deter the unauthorized access, loss, compromise, disclosure, modification, or destruction of Avalara’s electronic data assets and information, including personal information.
Avalara performs root cause analyses for incidents based on the nature of the incident, to identify, document, and eliminate the cause of an incident and to prevent the issue from recurring. Changes to the Avalara Incident Response Plan and standard operating procedures is also part of this review.
Security and audit logs are fed to the SIEM daily and retained for a period of one year. These logs cannot be modified by anyone.
Daily recoverable backups of critical data are configured to be performed and replicated to a secondary location.
Avalara maintains a Security Infraction Management Policy that describes how Avalara treats security incidents that result from deviations from Avalara’s security policies, standards, and procedures.
Avalara maintains standards for making changes to applications, including customer-facing applications, by ensuring they are tested and approved by appropriate individuals before they are moved to production. Access to make production changes is restricted to authorized individuals.
Avalara has established logical separation between production and lower environments.
Avalara ensures test data is selected and handled in accordance with the technical controls specified in this document.
All Avalara personnel must undergo the mandatory security awareness training at least annually.
The Avalara Service Terms and Conditions along with the Vendor Security terms document are in place to communicate security commitments with vendors.
The Avalara Security team periodically performs assessments of different systems by conducting phishing simulations, vulnerability scans, and penetration tests.
The Avalara Compliance team periodically performs assessments of key systems. Remediation plans are defined as appropriate for the areas of non-compliance establishing clear ownership and accountability.
The Avalara Risk Management Team periodically conducts risk assessments to identify risks arising from internal and external sources throughout the year to evaluate the organization's control environment. Risk treatment plans are defined, as appropriate, for identified risks including establishing clear ownership and accountability. Risks are monitored to acceptable mitigation according to the Avalara Security Risk Assessment Standard and Process.
Avalara maintains standards for Vendor Risk Management to define requirements for vendor selection, risk assessments with roles and responsibilities, contract lifecycle, exception handling and terminations.
Annex III
LIST OF SUB-PROCESSORS
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The controller has provided general authorisation for the engagement of subprocessors from an agreed list, available at Subprocessors (avalara.com).
Exhibit 2
The International Data Transfer Addendum to the EU SCCs (“UK addendum”), available at International data transfer agreement and guidance | ICO or on a successor website designated by the UK ICO, are incorporated herein by reference.
The parties are as reflected in the signature block to this DPA.
The parties select the version of the approved EU SCCs referenced in section 8 of this DPA including the appendix information which is as described in Exhibit 1.
The appendix information in table 3 of the UK addendum is as set out in the annexes to the EU SCCs in Exhibit 1.
The list of sub processors is as provided at Subprocessors (avalara.com).
Either party may end the UK addendum as set out in section 19 of the same.
California Consumer Privacy Act Disclosures
Version
Effective January 1st 2026
Download
Table of Contents
This Notice supplements information contained in Avalara’s US Privacy Notice and applies solely to residents of the State of California with respect to the personal information that Avalara, Inc. and its corporate business affiliates (“Avalara”) process. Any terms defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”), carry the same meaning when used in this Notice.
Personal Information Collected in the Last 12 Months
Avalara collects personal information relating to marketing programs, advertising activities, sales operations, lead enrichment, analytics, and events or webinars (“Website Activities”) from the following categories of sources:
Directly from you, including when you submit forms, register for events or webinars, communicate with Avalara, or otherwise interact with our websites or marketing materials.
Automatically, through your interaction with our websites, emails, advertisements, and digital content, including through cookies, pixels, tags, and similar technologies.
From other Avalara entities.
From third parties, service providers, and contractors, including advertising networks, analytics providers, social media platforms, lead enrichment providers, event partners, data providers, and other business partners.
The table below presents the categories of personal information Avalara has collected, shared for cross-context behavioral advertising, and disclosed to service providers or contractors for business purposes in the preceding twelve months. Note that disclosures to service providers or contractors are made for business purposes only and are subject to contractual restrictions.
Category of personal information and examples provided by the CCPA
Shared for cross-context behavioral advertising
Disclosed to service providers or contractors
Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Yes
Yes
Any personal information described under the California Customer Records Act (Cal. Civ. Code § 1798.80(e)), such as business contact and professional information, including name, signature, physical characteristics or description, address, telephone number, employment, or employment history.
“Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
Yes
Yes
Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Yes
Yes
Internet or other electronic network activity information, such as browsing history, search history, and information regarding your interaction with an internet website application, or advertisement.
Yes
Yes
Geolocation data.
Yes
Yes
Audio, electronic, visual, or similar information, such as recordings or transcripts of communications, including chatbot and live chat interactions, emails, calls, and event participation.
No
Yes
Professional or employment-related information.
Yes
Yes
Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Yes
Yes
Sensitive personal information, such as precise geolocation in connection with in-person events, tracking attendance for continuing professional education (CPE) reporting, and related compliance and security purposes.
No
Yes
Certain categories of personal information are shared only in specific contexts, such as lead generation, paid syndication, advertising measurement, or audience development. Avalara does not share all personal information within each category for cross-context behavioral advertising, and some information within a category may be used solely for internal purposes or disclosed only to service providers for business purposes.
Use of Personal Information in the Last 12 Months
Avalara uses personal information collected through Website Activities for the following purposes:
Marketing, advertising, and sales operations, including, for example, campaign delivery and measurement, segmentation, retargeting, personalization, lead capture, validation, enrichment, routing, qualification, and outreach. This may include collecting and analyzing information you provide through chatbots or live chat features to respond to inquiries, route requests, support sales and marketing activities, and improve our services.
Events, analytics, and performance measurement, including, for example, event and webinar registration and management, communications, follow-up, attribution, reporting, optimization, and forecasting.
Business operations, security and system integrity, including, for example, data normalization, monitoring, access control, and fraud prevention.
Legal and compliance purposes, including, for example, recordkeeping, audits, and responding to lawful requests.
Retention of Personal Information
Avalara retains personal information collected through Website Activities for periods that are reasonably necessary and proportionate to fulfill the purposes described in this Notice and in accordance with applicable law. Retention periods vary depending on the type of personal information; the context of your interactions with Avalara; whether the information is necessary to support ongoing business relationships, communications, or events; and applicable legal or business requirements.
Personal information is retained in accordance with Avalara’s data governance and retention practices and is reviewed periodically to ensure it remains necessary for the purposes described in this Notice. In limited circumstances, personal information may be retained for longer periods where required to satisfy legal, regulatory, audit, or compliance obligations, resolve disputes, or enforce agreements. When personal information is no longer reasonably necessary for these purposes, Avalara takes steps to delete or de-identify it in accordance with our retention policies.
Sharing / Selling of Personal Information in the Last 12 Months
Avalara shares personal information for purposes of cross-context behavioral advertising, as defined under the CCPA. This includes sharing personal information with advertising partners, analytics providers, social media platforms, and marketing or lead generation partners to deliver, measure, and optimize marketing campaigns.
The business and commercial purposes for this sharing include marketing and promoting Avalara’s products and services, delivering and measuring advertising and marketing campaigns, developing and refining audiences, and supporting sales and business development activities.
Avalara does not sell personal information for monetary consideration.
California residents have the right to opt out of the sale or sharing of personal information by emailing dataprivacy@avalara.com or calling our toll-free number at (877) 814-9390. Additionally, Avalara honors opt-out preference signals, including the Global Privacy Control (“GPC”).
Disclosure of Personal Information in the Last 12 Months
In the preceding 12 months, Avalara has disclosed the following categories of personal information, as defined by the CCPA, to service providers or contractors for one or more business purposes: identifiers; personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)); commercial information; internet or other electronic network activity information; geolocation data; audio, electronic, visual, or similar information; professional or employment-related information; inferences; and sensitive personal information.
Such disclosures are made to entities that perform services on Avalara’s behalf and at its direction. These entities are contractually required to use personal information only for specified business purposes, to protect it appropriately, and to comply with applicable privacy laws.
Disclosure may have occurred for the following business purposes:
Marketing, advertising, and sales enablement: We disclose personal information to service providers and contractors that support Avalara’s marketing, advertising, and sales operations, including platforms and services used to manage campaigns, generate and validate leads, facilitate communications, and support business development activities.
Analytics, measurement, and operational insight: We disclose personal information to service providers and contractors that assist with analytics, reporting, and performance measurement to understand engagement, demand, and the effectiveness of Avalara’s business activities.
Security, integrity, and reliability: We disclose personal information to service providers and contractors that help maintain the security, integrity, and reliability of Avalara’s systems, websites, and data.
Legal, compliance, and business administration: We disclose personal information to service providers and contractors that support legal and regulatory compliance, recordkeeping, audits, and other necessary business administration functions. This may include disclosures to Avalara’s private equity sponsor, Vista Equity Partners (US) and its affiliates, including Vista Consulting Group (collectively, “Vista”), in connection with governance, oversight, compliance, and permitted advisory activities.
Statement Regarding Avalara’s Use or Disclosure of Sensitive Personal Information
Avalara collects and uses limited categories of sensitive personal information, such as precise geolocation in connection with in-person events, only for purposes permitted under Section 7027(m) of the CCPA, including providing requested services, event administration, compliance, and security.
Accordingly, Avalara does not offer a right to limit the use or disclosure of sensitive personal information under the CCPA in this context.
Statement Regarding the Use of Automated Decision-Making Technology (“ADMT”)
Avalara uses automated processes to collect, route, enrich, and score leads and engagement data. However, Avalara does not use ADMT, as defined under the CCPA, to make decisions that produce legal or similarly significant effects concerning you without meaningful human involvement. Accordingly, Avalara does not offer rights to access information about or to opt out of ADMT under the CCPA for Website Activities.
Statement Regarding Selling or Sharing the Personal Information of Individuals Under the Age of 16
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal information from individuals under the age of 18. As such, Avalara does not have actual knowledge of selling or sharing the personal information of individuals under the age of 16 in connection with Website Activities.
Your Rights Under the CCPA
As a resident of California, you have certain rights with respect to your personal information. This section describes those rights and how you can exercise them.
Right to Know. You have the right to request that Avalara disclose to you (1) the categories of personal information that Avalara has collected about you and (2) the specific pieces of personal information Avalara has collected about you. This includes the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom Avalara discloses personal information.
Right to Delete. You have the right to delete personal information that Avalara has collected from you, subject to certain exceptions. We honor requests to delete unless an exception applies, such as when the information is necessary to complete the transaction or contract for which it was collected or when information is being used to detect, prevent, or investigate security incidents, comply with laws, or ensure another individual’s ability to exercise their rights provided by law.
Right to Correct. You have the right to correct inaccurate personal information that Avalara maintains about you.
Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your personal information, as those terms are defined under the CCPA.
Right Not to Be Retaliated Against. You have the right not to be retaliated against for exercising privacy rights conferred by the CCPA.
To submit a request to exercise a right, please email dataprivacy@avalara.com or call our toll-free number at (877) 814-9390.
When you submit a request to exercise your rights under the CCPA, Avalara will take steps to verify that you are the person making the request before we take action. We may ask you to provide information that reasonably enables us to match your request to personal information we already maintain about you in our systems. This may include information you have previously provided to us (such as your name or email address) and, where necessary, additional documentation or details to confirm your identity.
We will not require you to create an account in order to submit a request. Any personal information provided for verification purposes will be used solely to verify your identity and process your request, and not for any other purpose. Verification is not required for requests to opt out of the sale or sharing of personal information.
Authorized Agent
You may designate an authorized agent to submit a request under the CCPA on your behalf if:
the agent has written permission signed by you confirming that they are authorized to act for you; and
you directly confirm with Avalara that you provided the authorized agent with permission to submit the request.
We may also require that you provide any information that Avalara requests to verify your identity. The information that Avalara asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.
Contact Us
If you have any questions or concerns about this Notice, please contact us at:
Email address: dataprivacy@avalara.com.
Postal address: Avalara, Inc., Attention: Chief Legal Officer, 512 S. Mangum Street, Suite #100, Durham, NC 27701.
Effective January 1st 2025 to January 1st 2026
Download
Table of Contents
This notice and policy supplements information contained in the Privacy Notice and notices at collection provided by Avalara, Inc. and its corporate business affiliates (“Avalara”) and applies solely to residents of the State of California (“consumers” or “you”) with respect to personal information Avalara processes as a business. Any terms defined in the California Consumer Privacy Act of 2018, as amended from time to time, including by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”) have the same meaning when used in this notice and policy. This notice and policy does not reflect our collection, use, or disclosure of California residents’ personal information, or data subject rights, where an exception or exemption under the CCPA applies.
1. CCPA RIGHTS
As a California resident, you have the following rights under the CCPA:
The right to know what personal information we have collected about you, including the categories of personal information, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information we have collected about you.
The right to delete personal information that we have collected from you, subject to certain exceptions.
The right to correct inaccurate personal information that we maintain about you.
The right to opt-out of the sale or sharing of your personal information by us.
The right to limit our use and disclosure of sensitive personal information to purposes specified in subsection 7027(l) of the CCPA regulations. We do not use or disclose sensitive personal information for purposes other than those specified in subsection 7027(m) of the CCPA regulations.
The right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by the CCPA, in violation of California Civil Code § 1798.125, including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights
To submit a request to exercise a right, please submit an email request to dataprivacy@avalara.com or call our toll-free number at 1-877-814-9390.
You may opt-out of the sale or sharing of your personal information for targeted advertising through our Cookie Policy or by implementing the Global Privacy Control.
2. NOTICE AT COLLECTION ONLINE
We have set out below categories of personal information about California residents we collect online.
Category of personal information or sensitive personal information under CCPA definitions
Purpose for collection and use of personal information
Sold or shared
Retention time
Characteristics of protected classifications under California or federal law.
Comply with regulatory obligations.
No Employment data is retained for the duration of such relationships and to meet our regulatory obligations
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Specifically, real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, social security number, driver’s license number, passport number, and account name.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Yes
Online form data is deleted after five years of inactivity; log data is retained for a minimum of one year; employment data is retained for the duration of such relationships and to meet our regulatory obligations
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, address, telephone number, passport number, driver’s license or state identification card number, social security number, education, employment, employment history, and bank account number.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
No
Online form data is deleted after five years of inactivity; employment data is retained for the duration of such relationships and to meet our regulatory obligations
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, information regarding a consumer’s interaction with an internet website application or advertisement.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Yes
No more than 140 days
Geolocation data.
Specifically, location using IP addresses.
Provide and improve services.
Yes
30 days
Professional or employment related information.
Specifically, employer and job title.
Provide and improve services, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, white paper downloads, provide chat functionality on our website, follow up with you upon your registrations for online seminars or in-person events, provide material you request, understand your preferences to enhance your experience, and send you relevant information about us, our affiliates.
No
Online form data is deleted after five years of inactivity
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Contact details and password when users create an account with Avalara's website
No
Lifetime of customer
3. NOTICE OF COLLECTION OF SENSITIVE PERSONAL INFORMATION
We have set out below categories of sensitive personal information about California residents we collect.
Category of sensitive personal information under CCPA definitions
Purpose for collection and use of sensitive personal information
Sold or shared
Retention time
A consumer’s social security, driver’s license, state identification card, or passport number.
Provide services, authenticate for service access, fraud detection and prevention, security, including anti-money laundering and know-your-customer obligations, and onboarding processes for hired individuals.
No
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Provide services.
No
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s precise geolocation.
Specifically, a consumer’s precise geolocation within conference spaces.
Event planning and hosting, tracking attendance for CPE reporting, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
No
No more than 140 days.
A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
Specifically, racial or ethnic origin and citizenship or immigration status.
Comply with regulatory obligations.
No
The duration of the employment relationship and to meet our regulatory obligations.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages.
Fraud detection and prevention, and security.
No
To meet our regulatory obligations.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to employee benefits, leave, and accommodations.
Provide services.
No
The duration of the employment relationship and to meet our regulatory obligations.
4. OUR PERSONAL INFORMATION HANDLING PRACTICES IN 2024
We have set out below categories of personal information about California residents we have collected and disclosed for a business purpose in the preceding 12 months. The table is followed by a description of the purposes for which we collected personal information.
Category of personal information or sensitive personal information with reference to CCPA definitions
Categories of third parties to which personal information was disclosed
Business or commercial purpose for disclosure
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Specifically, real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, social security number, driver’s license number, passport number, and account name.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, or other financial information, medical information, or health insurance information.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Characteristics of protected classifications under California or federal law.
Specifically, gender, marital status, race/ethnicity, national origin, gender identity, disability, requests for family care leave, medical leave, pregnancy disability leave, military and veteran status, and age if 40 years or older.
Our service providers, including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, third parties subject to compelled disclosures, and payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, and better understand our employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Specifically, records of products or services purchased including those purchased by employees as work-related expenses.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, browsing history, search history, and information regarding a consumer’s interaction with an internet website application or advertisement.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Geolocation data.
Specifically, location information based on IP addresses and precise geolocation within conference spaces.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Audio, electronic, visual, thermal, olfactory, or similar information.
Specifically, data relating to Avalara employees’ use of computers, software, networks, communications devices, and other similar systems that we or our affiliates own or make available to you; or you connect to or use for the purposes of providing services to us or our affiliates; and information relating to your activities on our or our affiliates' premises.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Professional or Employment related information.
Specifically, job information, compensation, benefits, contact information, work history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
Specifically, education history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s social security, driver’s license, state identification card, or passport number.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, advertising, and fulfill anti-money laundering and know-your-customer obligations.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in, credentials allowing access to an account.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
Specifically, racial or ethnic origin and citizenship or immigration status.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages of Avalara employees.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, Avalara affiliates and subsidiaries, and to third parties subject to compelled disclosures.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as technical operations and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to receiving employee benefits, leaves, and accommodations.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Business or Commercial Purpose for Collecting Personal Information. Avalara uses the personal information that it collects to provide and improve services, authenticate for service access, detect and prevent fraud, security, troubleshoot, plan and host events, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Avalara collects such information from the following categories of sources:
Directly from You. Avalara may collect personal information when you: inquire about one of our services or purchase our services; send an email to Avalara or start a live chat with us; interact with our website, products or services; register for an event or seminar; download content like white papers; create an account with us; and use our mobile services.
Cookies and Other Technologies. Avalara and its affiliates and trusted third parties may use cookies or other technologies to collect data about your device and activity on our website.
Third Parties, including Service Providers. Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s services.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s services.
5. COMMITMENT REGARDING DEIDENTIFIED INFORMATION
If we process deidentified information, we will maintain the information in a deidentified form and not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether the deidentification processes used satisfy legal requirements.
6. AUTHORIZED AGENT
You can designate an authorized agent to make a request under the CCPA on your behalf if:
The authorized agent is a natural person or a business entity and the agent provides proof that you gave the agent signed permission to submit the request; and
You directly confirm with Avalara that you provided the authorized agent with permission to submit the request.
If you use an authorized agent to submit a request to exercise your right to know, correct or your right to request deletion, please provide any information Avalara requests to verify your identity. The information that Avalara asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.
If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.
7. CONTACT FOR MORE INFORMATION
If you have any questions or comments about this notice and policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us at:
Email address: dataprivacy@avalara.com
Postal address: Avalara, Inc., Attention: General Counsel, 512 S Mangum St #100, Durham, NC 27701
Effective April 30th 2024 to January 1st 2025
Download
Table of Contents
This notice and policy supplements information contained in the privacy policy (“Privacy Policy”) and notices at collection provided by Avalara, Inc. and its corporate business affiliates (“Avalara”) and applies solely to residents of the State of California (“consumers” or “you”) with respect to personal information Avalara processes as a business. Any terms defined in the California Consumer Privacy Act of 2018, as amended from time to time, including by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”) have the same meaning when used in this notice and policy. This notice and policy does not reflect our collection, use, or disclosure of California residents’ personal information, or data subject rights, where an exception or exemption under the CCPA applies.
1. CCPA RIGHTS
As a California resident, you have the following rights under the CCPA:
The right to know what personal information we have collected about you, including the categories of personal information, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information we have collected about you.
The right to delete personal information that we have collected from you, subject to certain exceptions.
The right to correct inaccurate personal information that we maintain about you.
The right to opt-out of the sale or sharing of your personal information by us.
The right to limit our use and disclosure of sensitive personal information to purposes specified in subsection 7027(l) of the CCPA regulations. We do not use or disclose sensitive personal information for purposes other than those specified in subsection 7027(m) of the CCPA regulations.
The right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by the CCPA, in violation of California Civil Code § 1798.125, including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights
To submit a request to exercise a right, please submit an email request to dataprivacy@avalara.com or call our toll-free number at 1-877-814-9390.
You may opt-out of the sale or sharing of your personal information for targeted advertising through our Cookie Policy or by implementing the Global Privacy Control.
2. NOTICE AT COLLECTION ONLINE
We have set out below categories of personal information about California residents we collect online.
Category of personal information or sensitive personal information under CCPA definitions
Purpose for collection and use of personal information
Sold or shared
Retention time
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Specifically, real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, social security number, driver’s license number, passport number, and account name.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Yes
Online form data is deleted after five years of inactivity; log data is retained for a minimum of one year
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, address, telephone number, social security number, education, employment, employment history, bank account number, medical information, or health insurance information.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
No
Online form data is deleted after five years of inactivity
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, information regarding a consumer’s interaction with an internet website application or advertisement.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Yes
No more than 140 days
Geolocation data.
Specifically, location using IP addresses.
Provide and improve services.
Yes
30 days
Professional or Employment related information.
Specifically, employer and job title.
Provide and improve services, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, to communicate with you, white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, provide material you request, understand your preferences to enhance your experience, and send you relevant information about us, our affiliates.
No
Online form data is deleted after five years of inactivity
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Contact details and password when users create an account with Avalara's website
No
Lifetime of customer
3. NOTICE OF COLLECTION OF SENSITIVE PERSONAL INFORMATION
We have set out below categories of sensitive personal information about California residents we collect.
Category of sensitive personal information under CCPA definitions
Purpose for collection and use of sensitive personal information
Sold or shared
Retention time
A consumer’s social security, driver’s license, state identification card, or passport number.
Provide services, authenticate for service access, fraud detection and prevention, security, including anti-money laundering and know-your-customer obligations, and onboarding processes for hired individuals.
No
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Provide services.
No
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
Comply with regulatory obligations.
No
The duration of the employment relationship and to meet our regulatory obligations.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages.
Fraud detection and prevention, and security.
No
To meet our regulatory obligations.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to employee benefits, leave, and accommodations.
Provide services.
No
The duration of the employment relationship and to meet our regulatory obligations.
4. OUR PERSONAL INFORMATION HANDLING PRACTICES IN 2023
We have set out below categories of personal information about California residents we have collected and disclosed for a business purpose in the preceding 12 months. The table is followed by a description of the purposes for which we collected personal information.
Category of personal information or sensitive personal information with reference to CCPA definitions
Categories of third parties personal information was disclosed to
Business or commercial purpose for disclosure
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information tothird parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, or other financial information, medical information, or health insurance information.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Characteristics of protected classifications under California or federal law.
Specifically, gender, marital status, race/ethnicity, gender identity, disability, requests for family care leave, medical leave, pregnancy disability leave, military and veteran status, and age if 40 years or older.
Our service providers, including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, third parties subject to compelled disclosures, and payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, and better understand our employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Specifically, records of products or services purchased including those purchased by employees as work-related expenses.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, browsing history, search history, and information regarding a consumer’s interaction with an internet website application or advertisement.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Geolocation data.
Specifically, location information based on IP addresses
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Audio, electronic, visual, thermal, olfactory, or similar information.
Specifically, data relating to Avalara employees’ use of computers, software, networks, communications devices, and other similar systems that we or our affiliates own or make available to you; or you connect to or use for the purposes of providing services to us or our affiliates; and information relating to your activities on our or our affiliates' premises.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Professional or Employment related information.
Specifically, job information, compensation, benefits, contact information, work history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
Specifically, education history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s social security, driver’s license, state identification card, or passport number.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in, credentials allowing access to an account.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
Specifically, racial or ethnic origin.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages of Avalara employees.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, Avalara affiliates and subsidiaries, and to third parties subject to compelled disclosures.
To service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as technical operations and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to receiving employee benefits, leaves, and accommodations.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
To service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also disclose
your data to our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose
your data to third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also disclose
your personal information to third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Business or Commercial Purpose for Collecting Personal Information. Avalara uses the personal information that it collects to provide and improve services, authenticate for service access, detect and prevent fraud, security, troubleshoot, plan and host events, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Avalara collects such information from the following categories of sources:
Directly from You. Avalara may collect personal information when you: inquire about one of our services or purchase our services; send an email to Avalara or start a live chat with us; interact with our website, products or services; register for an event or seminar; download content like white papers; create an account with us; and use our mobile services.
Cookies and Other Technologies. Avalara and its affiliates and trusted third parties may use cookies or other technologies to collect data about your device and activity on our website.
Third Parties, including Service Providers. Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s services.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s services.
5. COMMITMENT REGARDING DEIDENTIFIED INFORMATION
If we process deidentified information, we will maintain the information in a deidentified form and not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether the deidentification processes used satisfy legal requirements.
6. AUTHORIZED AGENT
You can designate an authorized agent to make a request under the CCPA on your behalf if:
The authorized agent is a natural person or a business entity and the agent provides proof that you gave the agent signed permission to submit the request; and
You directly confirm with Avalara that you provided the authorized agent with permission to submit the request.
If you use an authorized agent to submit a request to exercise your right to know, correct or your right to request deletion, please provide any information Avalara requests to verify your identity. The information that Avalara asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.
If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.
7. CONTACT FOR MORE INFORMATION
If you have any questions or comments about this notice and policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us at:
Email address: dataprivacy@avalara.com
Postal address: Avalara, Inc., Attention: General Counsel, 255 S. King Street, Suite 1200, Seattle, WA 98104
Effective January 1st 2024 to April 30th 2024
Download
Table of Contents
This notice and policy supplements information contained in the privacy policy (“Privacy Policy”) and notices at collection provided by Avalara, Inc. and its corporate business affiliates (“Avalara”) and applies solely to residents of the State of California (“consumers” or “you”) with respect to personal information Avalara processes as a business. Any terms defined in the California Consumer Privacy Act of 2018, as amended from time to time, including by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”) have the same meaning when used in this notice and policy. This notice and policy does not reflect our collection, use, or disclosure of California residents’ personal information, or data subject rights, where an exception or exemption under the CCPA applies.
1. RIGHT TO REQUEST DELETION, CORRECTION OF INACCURATE PERSONAL INFORMATION, AND SPECIFIC PIECES OF PERSONAL INFORMATION COLLECTED, RIGHT NOT TO RECEIVE DISCRIMINATORY TREATMENT FOR THE EXERCISE OF CCPA RIGHTS
You have the right to request that we disclose what personal information we collect, use, or disclose about you specifically and to request the correction and deletion of personal information. To submit a request to exercise a right, please submit an email request to dataprivacy@avalara.com or call our toll-free number at 1-877-814-9390.
Avalara may ask that you provide certain information to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. Avalara will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.
When a business sells your personal information or shares it for cross context behavioural advertising, you have a right to opt out of such sale or sharing. We do not have actual knowledge that we sell or share for cross context behavioral advertising, the personal information of California resident consumers under 16 years of age.
When a business uses or discloses sensitive personal information for reasons triggering an opt out right under the CCPA, you have the right to limit the use or disclosure of sensitive information by the business. We do not use or disclose sensitive personal information for purposes triggering a right to limit under the CCPA.
You have the right not to receive discriminatory treatment by a business for the exercise of privacy rights conferred by the CCPA in violation of California Civil Code § 1798.125, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their CCPA rights.
2. NOTICE AT COLLECTION ONLINE
We have set out below categories of personal information about California residents we collect online.
Category of personal information or sensitive personal information under CCPA definitions
Purpose for collection and use of personal information
Sold or shared
Retention time
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Specifically, real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, social security number, driver’s license number, passport number, and account name.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Shared
Online form data is deleted after five years of inactivity; log data is retained for a minimum of one year
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, address, telephone number, social security number, education, employment, employment history, bank account number, medical information, or health insurance information.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Shared
Online form data is deleted after five years of inactivity
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, information regarding a consumer’s interaction with an internet website application or advertisement.
Provide and improve services, authenticate for service access, fraud detection and prevention, security, troubleshoot, event planning and hosting, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Sold and shared
No more than 140 days
Geolocation data.
Specifically, location using IP addresses.
Provide and improve services.
Shared
30 days
Professional or Employment related information.
Specifically, employer and job title.
Provide and improve services, event planning and hosting, consider individuals for job opportunities and onboarding processes for hired individuals, to communicate with you, white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, provide material you request, understand your preferences to enhance your experience, and send you relevant information about us, our affiliates.
Shared
Online form data is deleted after five years of inactivity
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Contact details and password when users create an account with Avalara's website
Shared
Lifetime of customer
3. NOTICE OF COLLECTION OF SENSITIVE PERSONAL INFORMATION
We have set out below categories of sensitive personal information about California residents we collect.
Category of sensitive personal information under CCPA definitions
Purpose for collection and use of sensitive personal information
Sold or shared
Retention time
A consumer’s social security, driver’s license, state identification card, or passport number.
Provide services, authenticate for service access, fraud detection and prevention, security, including anti-money laundering and know-your-customer obligations, and onboarding processes for hired individuals.
Shared
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in and credentials allowing access to an account.
Provide services.
Shared
Customer and employee data is kept for the duration of such relationships and to meet our regulatory obligations; with respect to customer data, such obligations may vary by product.
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
Comply with regulatory obligations.
Shared
The duration of the employment relationship and to meet our regulatory obligations.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages.
Fraud detection and prevention, and security.
Shared
To meet our regulatory obligations.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to employee benefits, leave, and accommodations.
Provide services.
Shared
The duration of the employment relationship and to meet our regulatory obligations.
4. OUR PERSONAL INFORMATION HANDLING PRACTICES IN 2023
We have set out below categories of personal information about California residents we have collected and disclosed for a business purpose in the preceding 12 months. The table is followed by a description of the purposes for which we collected personal information.
Category of personal information or sensitive personal information with reference to CCPA definitions
Categories of third parties personal information was disclosed to
Business or commercial purpose for disclosure
Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))
Specifically, name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, or other financial information, medical information, or health insurance information.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Characteristics of protected classifications under California or federal law.
Specifically, gender, marital status, race/ethnicity, gender identity, disability, requests for family care leave, medical leave, pregnancy disability leave, military and veteran status, and age if 40 years or older.
Our service providers, including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, third parties subject to compelled disclosures, and payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, and better understand our employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Specifically, records of products or services purchased including those purchased by employees as work-related expenses.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
Specifically, browsing history, search history, and information regarding a consumer’s interaction with an internet website application or advertisement.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Geolocation data.
Specifically, location information based on IP addresses
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Audio, electronic, visual, thermal, olfactory, or similar information.
Specifically, data relating to Avalara employees’ use of computers, software, networks, communications devices, and other similar systems that we or our affiliates own or make available to you; or you connect to or use for the purposes of providing services to us or our affiliates; and information relating to your activities on our or our affiliates' premises.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Professional or Employment related information.
Specifically, job information, compensation, benefits, contact information, work history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
Specifically, education history.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s social security, driver’s license, state identification card, or passport number.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
Specifically, account log-in, credentials allowing access to an account.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
Specifically, racial or ethnic origin.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
Specifically, email messages of Avalara employees.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, Avalara affiliates and subsidiaries, and to third parties subject to compelled disclosures.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, maintain the security of our systems and networks, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as technical operations and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Personal information collected and analyzed concerning a consumer’s health.
Specifically, health information related to receiving employee benefits, leaves, and accommodations.
Our service providers including our CRM service provider, cloud services and data warehousing providers, data analytics providers, logging and log management services, HR and recruiting software providers, benefits providers, security services, communication and productivity software and services, social networks, Avalara affiliates and subsidiaries, partners, to third parties subject to compelled disclosures, and to payment processors.
We may share your data with service providers and vendors to perform services on our behalf, including to organize data, manage our employee base and provide benefits, better understand our customers, prospective customers, and employees, marketing, and advertising.
To our subsidiaries and affiliates (those entities under common control), to provide services, such as customer support, marketing, technical operations, and account management purposes.
To Vista, our private equity sponsor, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics and business operation purposes.
To our partners, to provide integrations that enable our services to interconnect with third party software and to support our mutual customers. We may also share your data with our partners to co-sponsor events that you choose to attend.
To our payment processor, to manage credit card processing.
To relevant governmental authorities if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also share your data with third parties, to protect our rights and property, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. We may also share your personal information with third parties to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Business or Commercial Purpose for Collecting Personal Information. Avalara uses the personal information that it collects to provide and improve services, authenticate for service access, detect and prevent fraud, security, troubleshoot, plan and host events, communicate with you, provide materials you request, including white paper downloads, provide chat functionality on our website, to follow up with you upon your registrations for online seminars or in-person events, understand your preferences to enhance your experience and send you relevant information about us, our affiliates, and partners.
Avalara collects such information from the following categories of sources:
Directly from You. Avalara may collect personal information when you: inquire about one of our services or purchase our services; send an email to Avalara or start a live chat with us; interact with our website, products or services; register for an event or seminar; download content like white papers; create an account with us; and use our mobile services.
Cookies and Other Technologies. Avalara and its affiliates and trusted third parties may use cookies or other technologies to collect data about your device and activity on our website.
Third Parties, including Service Providers. Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s services.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s services.
5. COMMITMENT REGARDING DEIDENTIFIED INFORMATION
If we process deidentified information, we will maintain the information in a deidentified form and not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether the deidentification processes used satisfy legal requirements.
6. AUTHORIZED AGENT
You can designate an authorized agent to make a request under the CCPA on your behalf if:
The authorized agent is a natural person or a business entity and the agent provides proof that you gave the agent signed permission to submit the request; and
You directly confirm with Avalara that you provided the authorized agent with permission to submit the request.
If you use an authorized agent to submit a request to exercise your right to know, correct or your right to request deletion, please provide any information Avalara requests to verify your identity. The information that Avalara asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.
If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.
7. CONTACT FOR MORE INFORMATION
If you have any questions or comments about this notice and policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us at:
Email address: dataprivacy@avalara.com
Postal address: Avalara, Inc., Attention: General Counsel, 255 S. King Street, Suite 1200, Seattle, WA 98104
EEA and United Kingdom Job Candidate Privacy Notice
Version
Effective August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
Effective December 10th 2022 to August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
India Job Candidate Privacy Notice
Version
Effective August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
Effective March 10th 2023 to August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
EEA & United Kingdom Privacy Notice
Version
Effective March 9th 2026
Download
Table of Contents
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
Questions and Complaints
Should you have a question about how we use your data or this Privacy Notice you should contact the Privacy Office, see contact details.
Under the Data (Use and Access) Act 2025 (DUAA), complainants must first raise their data protection concerns directly with Avalara (the data controller) before escalating the issue to the Information Commissioners Office (which will become the Information Commission). Avalara is required to:
• Acknowledge complaints within 30 days
• Investigate and respond without undue delay
• Keep the complainant informed of progress and outcomes
This new process aims to encourage resolution at the local level and reduce the burden on the regulator.
Complaints can be lodged here: dataprivacy@avalara.com
If you are dissatisfied with our response to your complaint relating to your data protection rights under the UK GDPR or the Data Use and Access Act 2025 (DUAA), you may escalate the matter to our Data Protection Officer (DPO).
You may do so if your complaint concerns:
• How your personal data has been collected, used, stored, or shared
• A response to a Subject Access Request (SAR)
• The handling of your request to rectify, erase, or restrict processing
• Concerns about automated decision-making or profiling
• Any other alleged infringement of your privacy rights under UK GDPR or Part 3 of the Data Protection Act 2018
Please note: Complaints relating to service delays, claims decisions, or technical issues do not fall within the scope of data protection law and cannot be escalated to the DPO.
To escalate a qualifying complaint, please contact our Privacy Office by email to dataprivacy@avalara.com or writing to the Data Protection Officer at Avalara, Lanchester House, Trafalgar Place, Brighton, United Kingdom, BN1 4FU
If you remain dissatisfied with the final outcome of your complaint after it has been reviewed by our Data Protection Officer (DPO), you have the right to escalate the matter to the Information Commission, the UK’s independent authority for data protection.
You may do so if your complaint relates to:
• A breach of your data protection rights under the UK GDPR or Part 3 of the Data Protection Act 2018
• How your personal data has been collected, used, stored, or shared
• Our handling of your Subject Access Request (SAR) or other rights request
• Concerns about automated decision-making or profiling
The Information Commission will consider whether we have complied with our legal obligations.
You can submit your complaint to the Information Commission via their website:
https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
If you reside in the EEA or the United Kingdom, Avalara Europe Ltd, located at Lanchester House, First Floor, Trafalgar Place, Brighton, United Kingdom, BN1 4FU, is the controller for your personal data.
For all other individuals, Avalara, Inc., located at 512 S Mangum St #100, Durham, NC 27701, USA, is the controller for your personal data. Our telephone number is 1-877-814-9390.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have a question about our Privacy Notice or the information we hold about you then please contact:
Name: The Data Protection Officer
Address: Lanchester House, Trafalgar Place, Brighton, United Kingdom, BN1 4FU
Email: dataprivacy@avalara.com
Effective August 5th 2025 to March 9th 2026
Download
Table of Contents
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
If you reside in the EEA or the United Kingdom, Avalara Europe Ltd, located at Lanchester House, First Floor, Trafalgar Place, Brighton, United Kingdom, BN1 4FU, is the controller for your personal data.
For all other individuals, Avalara, Inc., located at 512 S Mangum St #100, Durham, NC 27701, USA, is the controller for your personal data. Our telephone number is 1-877-814-9390.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective August 5th 2025 to August 5th 2025
Download
Table of Contents
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
If you reside in the EEA or the United Kingdom, Avalara Europe Ltd, located at Lanchester House, First Floor, Trafalgar Place, Brighton, United Kingdom, BN1 4FU, is the controller for your personal data.
For all other individuals, Avalara, Inc., located at 512 S Mangum St #100, Durham, NC 27701, USA, is the controller for your personal data. Our telephone number is 1-877-814-9390.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective July 18th 2025 to August 5th 2025
Download
Table of Contents
Last Updated: July 10, 2025
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
If you reside in the EEA or the United Kingdom, Avalara Europe Ltd, located at Lanchester House, First Floor, Trafalgar Place, Brighton, United Kingdom, BN1 4FU, is the controller for your personal data.
For all other individuals, Avalara, Inc., located at 512 S Mangum St #100, Durham, NC 27701, USA, is the controller for your personal data. Our telephone number is 1-877-814-9390.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective July 11th 2025 to July 18th 2025
Download
Table of Contents
Last Updated: July 10, 2025
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
If you reside in the EEA or the United Kingdom, Avalara Europe Ltd, located at Lanchester House, First Floor, Trafalgar Place, Brighton, United Kingdom, BN1 4FU, is the controller for your personal data.
For all other individuals, Avalara, Inc., located at 512 S Mangum St #100, Durham, NC 27701, USA, is the controller for your personal data. Our telephone number is 1-877-814-9390.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective July 11th 2025 to July 11th 2025
Download
Table of Contents
Last Updated: July 10, 2025
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller. Such cases of processing will be governed by your company or organization’s own privacy policy. Information detailing how Avalara processes personal data as a data processor can be found here.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective July 10th 2025 to July 11th 2025
Download
Table of Contents
Last Updated: July 10, 2025
Avalara is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Category of personal data
Purpose
Service enabled through data processing
Contact details.
When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation, login, account management, service-related communications.
Billing data.
When you purchase Services or register to attend an event, we may collect billing and payment information.
Facilitating purchase of services
Device and usage data.
When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Service performance and functionality
Security and fraud prevention
Analytics and usage insights
Personalization of User Experience
Compliance and Reporting
Data from our mobile apps.
When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Facilitation of account-related communication
Provide location-based services
Facilitate invoice process
Chat data.
When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Customer support and issue resolution
Service quality assurance and agent training
Audit and legal compliance
Cookies and Other Technologies.
When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Maintaining user sessions during login
Server performance
Saving user interface customizations
Consent management
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data as follows:
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights herein this Privacy Notice.
How We Retain Your Personal Data
Retention and Deletion of Data. Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third- party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
Your Rights as the Data Subject
Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.
Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.
Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.
Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.
You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller. Such cases of processing will be governed by your company or organization’s own privacy policy. Information detailing how Avalara processes personal data as a data processor can be found here.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective May 28th 2024 to July 10th 2025
Download
Table of Contents
Last Updated: May 28, 2024
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective March 27th 2024 to May 28th 2024
Download
Table of Contents
Last Updated: February 14, 2023
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 255 South King Street, Suite 1800, Seattle, Washington 98104. Our telephone number is . If you use Avalara’s Services through your company or organization, then Avalara is the data processor with respect to your data and your company or organization is the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective February 14th 2023 to March 27th 2024
Download
Table of Contents
Last Updated: February 14, 2023
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 255 South King Street, Suite 1800, Seattle, Washington 98104. Our telephone number is . If you use Avalara’s Services through your company or organization, then Avalara is the data processor with respect to your data and your company or organization is the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Subprocessors
Version
Effective September 9th 2026
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
July 7, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
Avalara Technologies RO
Romania
Avalara Denmark ApS
Denmark
Avalara BV
Netherlands
Avalara Hellas Mon. Epe
Greece
Avalara Portugal Lda
Portugal
Avalara Oy
Finland
Avalara France
France
INPOSIA Solutions GmbH
Germany
Avalara Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective November 20th 2025 to September 9th 2026
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
July 7, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
Avalara Technologies RO
Romania
Avalara Denmark ApS
Denmark
Avalara BV
Netherlands
Avalara Hellas Mon. Epe
Greece
Avalara Portugal Lda
Portugal
Avalara Oy
Finland
Avalara France
France
INPOSIA Solutions GmbH
Germany
Avalara Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective October 20th 2025 to November 20th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
July 7, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Oy
Finland
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective October 14th 2025 to October 20th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
July 7, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Oy
Finland
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective July 7th 2025 to October 14th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
July 7, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Oy
Finland
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective July 7th 2025 to July 7th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
May 31, 2025
Omni Analytics, Inc.
Business intelligence platform for embedded analytics
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Oy
Finland
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective April 16th 2025 to July 7th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Oy
Finland
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
VAT House Services NV
Belgium
Effective April 20th 2024 to April 16th 2025
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
April 20, 2024 Monte Carlo Data, Inc. Application analytics service United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Limited
United Kingdom
Impendulo Limited (CY)
Cyprus
Impendulo Oy
Finland
Impendulo SARL
France
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
Transaction Tax Consulting Group, LLC
United States
Transaction Tax Resources, Inc.
United States
VAT Applications NV
Belgium
VAT House Services NV
Belgium
Effective February 20th 2024 to April 20th 2024
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
February 20, 2024 OwnBackup Inc.
Data backup service United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Limited
United Kingdom
Impendulo Limited (CY)
Cyprus
Impendulo Oy
Finland
Impendulo SARL
France
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
Transaction Tax Consulting Group, LLC
United States
Transaction Tax Resources, Inc.
United States
VAT Applications NV
Belgium
VAT House Services NV
Belgium
Effective November 1st 2023 to February 20th 2024
Download
Table of Contents
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
November 1, 2023 Cribl, Inc. Cloud-based data observability platform United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Limited
United Kingdom
Impendulo Limited (CY)
Cyprus
Impendulo Oy
Finland
Impendulo SARL
France
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
Transaction Tax Consulting Group, LLC
United States
Transaction Tax Resources, Inc.
United States
VAT Applications NV
Belgium
VAT House Services NV
Belgium
Effective October 26th 2023 to November 1st 2023
Download
Table of Contents
Last updated: June 21, 2023
Avalara uses third parties, subprocessors, to provide specific functionality within Avalara’s services. If Customer objects to the addition of a subprocessor, Customer must email legal@avalara.com. Otherwise, continued use of the Services signifies Customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of Avalara’s customers:
Date Added
Entity Name
Purpose
Entity Control
February 24, 2020
Adobe, Inc.
Tag management system
United States
February 24, 2020
Amazon Web Services, Inc. (AWS)
Cloud-based computing and data hosting services
United States
February 24, 2020
Atlassian Pty Ltd.
Cloud-based project management and collaboration software tools
Australia
June 17, 2022 BigID, Inc. Data discovery and privacy compliance services United States
June 17, 2022
Confluent, Inc. Event data processing and real-time data pipeline engine United States
June 17, 2022
Content Square, Inc. Customer experience analytics service United States
June 17, 2022
Databricks, Inc. Cloud-based data warehousing United States
February 24, 2020
FullStory, Inc.
Customer experience analytics service
United States
March 13, 2023 Hex Technologies, Inc. Application analytics service United States
September 3, 2021
IDology, Inc.
Age verification service for Avalara Age Verification (an add-on feature to AvaTax for Beverage Alcohol)
United States
February 24, 2020
Microsoft Corporation
Cloud-based and on-premises office productivity tools and a business analytics service
United States
February 10, 2022
Mimecast North America, Inc.
Email security and archiving
United States
April 3, 2020
MongoDB, Inc.
General purpose database platform
United States
February 24, 2020
Okta, Inc.
Cloud-based access management service
United States
June 21, 2023 Proofpoint, Inc. Security tool United States
February 24, 2020
Rapid 7 Ireland Limited
Log management and analytics service
United States
February 24, 2020
Salesforce.com, Inc.
Customer management platform
United States
February 24, 2020
Slack Technologies, Inc.
Communication and productivity software as a service and related technology
United States
June 8, 2020
Snowflake Inc.
Cloud-based data warehousing
United States
February 24, 2020
Splunk, Inc.
Real-time cloud monitoring service
United States
February 24, 2020
Sumo Logic, Inc.
Cloud-based logs and metrics management service
United States
February 24, 2020
Twilio, Inc.
Customer data infrastructure platform
United States
September 17, 2020
Uplevel, Inc.
Data analysis tool relating to Avalara team behavior to maximize effectiveness
United States
Avalara Group Sub-processors
The following entities are subsidiaries or affiliates of Avalara (as Avalara is defined in the Terms). Accordingly, they function as subprocessors when they perform activities to provide the Services. Depending on the geographic location of Customer and the Services provided, Avalara may engage one or more of its subsidiaries or affiliates as subprocessors to deliver some or all of the Services provided to Customer. Avalara subsidiaries or affiliates are as follows:
Entity Name
Country
Avalara, Inc.
United States
AFT France SAS
France
AFT Italy S.r.L.
Italy
Avalara FT Spain SL
Spain
AFTC Fiscal Services UK Ltd
United Kingdom
AFTC, Inc.
United States
AvaFuel LLC
United States
Avalara Brasil – Assessoria e Consultoria Tributária e Tecnológica Ltda
Brazil
Avalara Canada ULC
Canada
Avalara Client Trust
United States
Avalara EU Holdings UK Limited
United Kingdom
Avalara Europe Ltd
United Kingdom
Avalara FT Poland
Polish
Avalara Luxembourg S.a.r.l.
Luxembourg
Avalara Technologies Private Limited
India
EDIGrid Romania
Romania
Impendulo ApS
Denmark
Impendulo BV
Netherlands
Impendulo Hellas Mon. Epe
Greece
Impendulo Lda
Portugal
Impendulo Limited
United Kingdom
Impendulo Limited (CY)
Cyprus
Impendulo Oy
Finland
Impendulo SARL
France
INPOSIA Solutions France
France
INPOSIA Solutions GmbH
Germany
INPOSIA Solutions Italia S.r.L.
Italy
INPOSIA Turkey
Turkey
Transaction Tax Consulting Group, LLC
United States
Transaction Tax Resources, Inc.
United States
VAT Applications NV
Belgium
VAT House Services NV
Belgium
United States Job Candidate Privacy Notice
Version
Effective August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
Effective January 1st 2023 to August 24th 2026
Download
Table of Contents
Page: /
Please download the PDF to view this document. Download
Política de Cookies
Version
Effective August 19th 2025
Download
Table of Contents
Política de Cookies
Última atualização: 06 de maio de 2024.
Esta política descreve como a Avalara e suas afiliadas (coletivamente, “nós” ou “nosso”) e terceiros confiáveis utilizam cookies e outras tecnologias semelhantes em nosso site www.avalara.com (o “Site”), bem como suas preferências e escolhas relacionadas a essas tecnologias. O objetivo desta Política é fornecer informações sobre o que são cookies e como eles funcionam. Ela também explica quais cookies usamos, o que eles fazem e como você pode controlá-los quando visita nosso site.
Nosso Site
Esta Política se refere apenas ao uso do nosso Site. Ao longo do nosso Site, podemos fazer referência a links de outros sites de propriedade e operados por terceiros confiáveis para veicular anúncios ou fornecer serviços analíticos. Esses sites de terceiros também podem usar cookies ou tecnologias semelhantes de acordo com suas próprias políticas separadas. Para informações de privacidade relacionadas a esses outros sites de terceiros, consulte suas respectivas políticas, conforme aplicável.
O Que São Cookies?
Cookies são pequenos arquivos de dados que são armazenados em seu navegador ou dispositivo quando você visita nosso Site. Os cookies geralmente contêm informações como preferências do site, configurações do usuário e histórico de navegação. Eles nos ajudam a reconhecer você e lembrar de coisas sobre seu dispositivo para que sua interação com nosso Site seja fácil e significativa.
Os cookies podem ser fornecidos por nós (“cookies primários”) ou por terceiros confiáveis (“cookies de terceiros”). Por exemplo, usamos cookies primários para lembrar suas configurações e preferências, como idioma e localização. Podemos também usar cookies de terceiros, como Google e Adobe Analytics, para nos ajudar a entender como você está interagindo com nosso Site para que possamos melhorá-lo.
Também usamos tecnologias semelhantes, também chamadas de pixels, que são pequenas imagens em uma página da web ou em um e-mail. Essas tecnologias nos ajudam a:
Rastrear e entender como você usa e interage com nosso Site;
Adaptar nosso Site às suas preferências;
Medir a eficácia de nossas promoções e anúncios em sites de terceiros; e
Gerenciar e melhorar nosso Site de outras formas.
Como Usamos Cookies
Os cookies desempenham um papel importante em nos ajudar a fornecer um Site eficaz e seguro. Por exemplo, usamos essas tecnologias para nos ajudar a determinar a popularidade de determinados conteúdos, melhorar nosso Site e a experiência do usuário, bem como para entender melhor sua atividade online. Os cookies que usamos são agrupados pelos tipos de cookies abaixo e geralmente se enquadram em uma ou mais das seguintes categorias:
[BOTÃO – CONFIGURAÇÕES DE PRIVACIDADE]
Estritamente Necessários
Esses cookies são necessários para o funcionamento do nosso Site. Eles geralmente são configurados apenas em resposta a ações realizadas por você, como uma solicitação de serviços, definição de suas preferências de privacidade, login ou preenchimento de formulários. Você pode configurar seu navegador para bloquear ou alertar sobre esses cookies, mas algumas partes do Site podem não funcionar. Esses cookies não armazenam nenhum dado pessoal.
Host
Cookies
Cookies Usados
Duração
www.avalara.com
driftevent, drift_aid, OptanonConsent, affinity, OptanonAlertBoxClosed, driftt_aid, drift_campaign_refresh
Primários
sessão, 2 anos, 365 dias, sessão, 365 dias, 2 anos, sessão
Cookies de Desempenho
Esses cookies nos permitem contar visitas e fontes de tráfego para que possamos medir e melhorar o desempenho do nosso Site. Eles nos ajudam a saber quais páginas são as mais e menos populares e a ver como os visitantes se movimentam pelo Site. Todas as informações que esses cookies coletam são agregadas e, portanto, anônimas. Se você não permitir esses cookies, não saberemos quando você visitou nosso Site e não poderemos monitorar seu desempenho.
Host
Cookies
Cookies Usados
Duração
businesslicenses.com
gpv_page
Primários
sessão
doubleclick.net
__ar_v4
Primários
6 meses
bing.com
MUID
Primários
1 ano
avalara.com
s_vnum, AMCVS_, uetvid, AMCV, s_cc, _uetsid, s_visit, s_ppv, s_getNewRepeat30, cs_mk*, gpv_v52, gpv_c51, s_ecid, tld, s_invisit, s_lv_s, s_ptc, s_lv, tp, s_sq
Primários
30 dias, sessão, 13 meses, 2 anos, sessão, 1 dia, 1 dia, sessão, 30 dias, sessão, sessão, sessão, 2 anos, sessão, sessão, 3 anos, sessão, 3 anos, sessão, sessão
www.avalara.com
at_check, _uetmsclkid, tatari-session-cookie, tatari-cookie-test, ava-vat-validator-session, _gclxxxx, _cs_cvars, s_ivc, _cs_c, _avaQv, _cs_ex, _cs_optout, avalarasalesdownloads, coveo_visitorId, _cs_s, coveo_visit_ID, _avaQvTest, _cs_id, mbox, _gcl_au
Primários
sessão, sessão, 1 semana, 1 semana, sessão, sessão, sessão, sessão, 13 meses, sessão, 30 dias, 13 meses, sessão, sessão, sessão, sessão, sessão, 13 meses, 2 anos, 90 dias
j.6sc.co
_an_uid
Primários
7 dias
youtube.com
DEVICE_INFO, YSC, VISITOR_INFO1_LIVE
Terceiros
6 meses, sessão, 178 dias
Cookies de Segmentação
Esses cookies podem ser configurados por meio do nosso Site por nós e por nossos parceiros de publicidade. Eles podem ser usados por essas empresas para criar um perfil dos seus interesses e mostrar anúncios relevantes em outros sites. Se você não permitir esses cookies, verá menos publicidade direcionada.
Host
Cookies
Cookies Usados
Duração
dpm.demdex.net
demdex
Primários
6 meses
avalara.com
_fbp
Primários
90 dias
google.com
NID
Primários
6 meses
linkedin.com
AnalyticsSyncHistory, li_gc
Primários
30 dias, 6 meses
www.avalara.com
_fbc, _gd_visitor, _gd_session, ELOQUA, _gd_svisitor, ELQSTATUS
Primários
90 dias, 2 anos, 1 dia, 1 ano, 2 anos, 1 ano
doubleclick.net
IDE
Primários
13 meses
adnxs.com
uuid2, anj
Terceiros
3 meses, 3 meses
everesttech.net
everest_g_v2, everest_session_v2
Terceiros
2 anos, sessão
linkedin.com
li_gc, li_sugr, lang, bcookie, AnalyticsSyncHistory, UserMatchHistory, lidc
Terceiros
6 meses, 89 dias, sessão, 364 dias, 30 dias, 29 dias, 1 dia
dpm.demdex.net
dextp, dpm
Terceiros
6 meses, 6 meses
bidr.io
bito, checkForPermission, bitoIsSecure
Terceiros
395 dias, 1 ano, 395 dias
youtube.com
CONSENT
Terceiros
2 anos
6sc.co
6suuid
Terceiros
2 anos
google.com
NID
Terceiros
182 dias
demdex.net
dextp
Terceiros
179 dias
doubleclick.net
IDE
Terceiros
13 meses
www.linkedin.com
bscookie
Terceiros
364 dias
Conforme descrito acima, temos parceria com a Microsoft Advertising, dentre outros terceiros confiáveis, para fornecer serviços de publicidade e análise. Para mais informações sobre como a Microsoft coleta e usa informações pessoais, consulte a Declaração de Privacidade da Microsoft.
Suas Escolhas
Exceto pelos cookies "Estritamente Necessários", que são necessários para o funcionamento do nosso Site, você pode escolher se aceita cookies através do nosso Centro de Preferências de Privacidade, clicando no botão "Configurações de Privacidade" acima. Como os cookies podem ser uma parte importante do funcionamento do nosso Site, se você remover ou rejeitar cookies, pode perder algumas funcionalidades do nosso Site.
5. Configurações do Seu Navegador
Seu navegador inclui controles que permitem gerenciar o uso de cookies pelos sites que você visita. A maioria dos navegadores possui recursos que permitem ver e excluir cookies armazenados em seu dispositivo e bloquear cookies de todos ou de sites selecionados.
Seu navegador pode estar inicialmente configurado para aceitar cookies, mas você pode alterar suas configurações para notificá-lo quando um cookie estiver sendo definido ou atualizado, ou para bloquear cookies completamente.
Observe que, ao bloquear quaisquer ou todos os cookies, você pode não ter acesso a certos recursos, conteúdos ou personalizações disponíveis.
Consulte as configurações do seu navegador para mais informações.
6. Alterações a Esta Política
Podemos atualizar ou alterar as tecnologias que usamos de tempos em tempos. A versão mais atualizada desta Política será publicada nesta página e, se fizermos quaisquer alterações, atualizaremos a data de vigência no início da Política.
7. Contato
Se você tiver alguma dúvida sobre o uso de cookies ou sobre esta Política, entre em contato conosco pelo canal dataprivacy@avalara.com.
Política de Privacidade da Avalara do Brasil
Version
Effective June 13th 2025
Download
Table of Contents
Atualizado pela última vez em: 30 de maio de 2025
Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda. está comprometida a proteger a privacidade dos indivíduos cujos dados pessoais nós tratamos (“você” ou “seu”). A Avalara poderá tratar dados pessoais de indivíduos que se cadastrem para utilizar os serviços, aplicativos e programas da Avalara (“Serviços”), visitantes do nosso site, indivíduos que solicitem informações, clientes em potencial, e participantes de eventos. Esta Política de Privacidade descreve como a Avalara e suas subsidiárias e afiliadas (“Avalara” ou “nós”) coletam, usam, e compartilham dados pessoais, bem como as escolhas oferecidas pela Avalara sobre a coleta e utilização de dados pessoais, respeitando as leis e regulamentações aplicáveis, incluindo a lei 13.709/2018 – Lei Geral de Proteção de Dados Pessoais (“LGPD”).
Dados Pessoais Tratados
Dados que coletamos de você:
A Avalara coleta dados pessoais diretamente de você, por exemplo, quando você solicita informações sobre um Serviço da Avalara ou envia um e-mail à Avalara, ou das suas interações com nosso site, produtos ou Serviços. Detalhes incluem:
Dados de Contato. Quando você solicita informações sobre nossos Serviços, se registra para um evento ou seminário, baixa conteúdo como artigos, se comunica conosco por e-mail, ou participa de uma conversa ao vivo por chat, podemos coletar seus dados de contato, como seu nome, empresa, endereço, telefone, fax, e endereço de e-mail. Se a sua empresa utiliza os Serviços e nós te fornecemos uma conta, nós podemos coletar o seu nome, endereço de e-mail, e endereço de IP associado, como parte da utilização dos Serviços pela sua empresa.
Criação de conta. Quando você cria uma conta conosco pelo nosso site, nós podemos coletar seus dados de contato e senha.
Dados de cobrança. Quando você adquire Serviços ou registra sua presença em um evento, nós podemos coletar informações de cobrança e pagamento.
Dados de uso e de dispositivo. Quando você usa o nosso site ou nossos Serviços, nós podemos também coletar automaticamente dados sobre o seu dispositivo e sobre o seu uso e atividade no nosso site e nos Serviços. Por exemplo, nós coletamos o tipo de sistema operacional que o seu dispositivo utiliza, endereço de IP, identificadores de dispositivo, tipo de navegador, nome de domínio, horário de acessos, e a duração da visita, bem como outras informações.
Dados dos nossos aplicativos móveis. Quando você usa nossos Serviços móveis, nós podemos coletar suas informações de contato, a localização geográfica do seu dispositivo, as informações de localização geográfica que você fornece aos nossos Serviços e as áreas geográficas derivadas do seu endereço de IP. Nós podemos também coletar informações sobre suas faturas, como endereço, número da fatura, número de certificado de isenção, descrição de itens, quantidades e valores.
Dados de conversa por chat. Quando você inicia uma conversa ao vivo por chat, a Avalara coletará um registro sobre a sua interação com os agentes de conversa por chat da Avalara.
Cookies e Outras Tecnologias. Quando você navega no nosso site, nós podemos usar cookies ou outras tecnologias para coletar dados sobre seu dispositivo e atividade no nosso site. Para mais informações sobre Cookies e Outras Tecnologias que utilizamos, os dados que coletamos e as suas opções, por favor clique aqui.
Dados pessoais coletados de outras fontes:
A Avalara poderá também coletar dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e nós podemos combinar esses dados com os dados que já possuímos sobre você. Por exemplo, podemos coletar dados pessoais de:
Parceiros. A Avalara poderá iniciar atividades conjunta de marketing ou patrocínios a eventos com nossos parceiros e podemos coletar os seus dados pessoais a partir dessas atividades. Nós também podemos permitir que parceiros nos indiquem indivíduos que possam se interessar em saber mais sobre os Serviços da Avalara. Nossos parceiros deverão obter a sua permissão antes de compartilhar os seus dados pessoais conosco.
Prestadores de Serviços. A Avalara também pode contratar terceiros prestadores de serviço que nos auxiliam a compreender como nossos clientes utilizam os Serviços da Avalara.
Como Utilizamos os Seus Dados Pessoais
A Avalara utiliza os seus dados para prestar e melhorar os Serviços que você ou a sua empresa solicitem, para se comunicar com você, e para promover anúncios a você por meio de terceiros revendedores.
Prestando e melhorando os Serviços Avalara. A Avalara usa os seus dados, ou os dados que coletamos quando você usa os nossos Serviços, para operar os nossos Serviços, fornecer os Serviços que você ou sua empresa tenha solicitado, e para melhoria contínua de nossa oferta de Serviços, sistemas internos, site e processos. Nós podemos usar os seus dados para autenticar o seu acesso e o seu uso aos Serviços. Nós também podemos usar os seus dados para detectar e prevenir fraudes, proteger a segurança do nosso site e dos nossos Serviços, e melhorar a segurança dos nossos Serviços.
Nós também podemos utilizar os dados que você forneceu ou coletados por terceiros prestadores de serviços ou parceiros, a nosso pedido, para resolver problemas ou fornecer suporte ao consumidor
Nós também podemos usar os seus dados para planejar e organizar eventos corporativos, incluindo webinars.
Comunicação com você. O site da Avalara permite que você baixe artigos, preencha formulários para mais detalhes sobre os nossos Serviços, e para iniciar conversas pela nossa funcionalidade de chat. Você também pode se registrar para participar de seminários online ou eventos presenciais. Nós usamos essa informação para lhe fornecer o material solicitado, para acompanhar os seus interesses nos Serviços, ou para registrá-lo em um evento. Nós também podemos usar dados pessoais para entender você e as suas preferências, de modo que possamos melhorar a sua experiência e enviar a você informações sobre a Avalara, nossas afiliadas, e nossos parceiros, como informações sobre promoções e eventos.
A Avalara também poderá receber dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e combiná-los com os seus dados que já possuímos. Isso nos ajuda a atualizar, expandir e analisar nossos registros, identificar novos consumidores e criar publicidades customizadas para oferecer produtos e serviços que possam ser do seu interesse.
Se você seguir ou curtir a Avalara em sites de redes sociais de terceiros, nós poderemos ver seu perfil público e poderemos direcionar publicidade a você.
Publicidade. Nós podemos usar os dados coletados via cookies e outras tecnologias para configurar nossa publicidade em outros sites ou para realizar ofertas ou propagandas a você, incluindo para serviços de terceiros, com base nas suas atividades de navegação e interesses. Para mais detalhes, clique aqui. Também podemos usar seus dados de contato enviados quando você baixa algum material disponibilizado em nosso website para enviar informações sobre outros serviços da Avalara.
Porque Compartilhamos Dados Pessoais
Prestadores de Serviço. A Avalara poderá compartilhar seus dados com nossos prestadores de serviço contratados e fornecedores, par que esses prestadores de serviços e fornecedores possam prestar serviços a nosso pedido. Por exemplo, nós usamos plataformas de CRM ou plataformas de análise de dados de terceiros para organizar dados e melhor compreender nossos clientes e clientes em potencial. Esses prestadores de serviço estão autorizados a usar os seus dados apenas conforme o necessário para a prestação dos serviços solicitados a nós. Nós podemos também compartilhar dados pessoais com sites de redes sociais profissionais de terceiros, como o LinkedIn, para nossas atividades de marketing e publicidade nesses sites. A menos que descrito nessa Política de Privacidade, a Avalara não compartilha, vende, aluga, ou comercializa nenhum dado com terceiros para os propósitos promocionais desses terceiros.
Afiliadas e Subsidiárias. Nós podemos compartilhar os seus dados com nossas subsidiárias e afiliadas para prestar os Serviços que você solicitar, tais como para propósitos de suporte ao consumidor, marketing, operação técnica, e gerenciamento de contas. Também podemos compartilhar dados com sociedades que planejam adquirir toda ou parte dos negócios da Avalara.
Parceiros da Avalara. A extensa rede de parceiros da Avalara oferece uma ampla gama de integrações que permitem que nossos Serviços se interconectem com softwares de terceiros. Nós podemos compartilhar os seus dados com esses parceiros para auxiliar nossos clientes em comum. Nós também podemos compartilhar os seus dados com nossos parceiros que copatrocinem eventos que você decida comparecer.
Cobrança. A Avalara utiliza terceiros prestadores de serviços para gerenciar o processamento de cartão de crédito. Esse prestador de serviço não tem permissão para armazenar, reter ou utiliza suas informações de cobrança, exceto para o único propósito de processar compras em cartão de crédito a nosso pedido.
Divulgação Obrigatória. A Avalara se reserva o direito de compartilhar os seus dados se necessário por lei ou para cumprir com procedimento judicial, ordem judicial ou processo legal válido. Nós também podemos divulgar os seus dados para proteger os direitos e propriedade da Avalara, nossos agentes, empregados, parceiros e clientes, incluindo para prevenir ou interromper um ataque nos nossos sistemas ou redes, ou para prevenir spam ou tentativas de fraudar nossos usuários. Por fim, nós também podemos divulgar os seus dados durante uma negociação de fusão, financiamento, aquisição, falência, dissolução, transação ou procedimento envolvendo a venda, transferência, desinvestimento ou divulgação de todo ou de parte de nossos negócios ou ativos a outra empresa.
Como Gerenciar seus Dados Pessoais
Preferências de Comunicação. Se você recebeu comunicação promocional da Avalara por e-mail e deseja se descadastrar de futuras comunicações, você pode clicar no botão “descadastrar”, localizado no final da mensagem de e-mail, ou você pode fazê-lo aqui. Se você se descadastrar das comunicações promocionais, você poderá ainda receber algumas mensagens relacionadas a notificações do Serviço, atualizações dos nossos termos ou Política de Privacidade, ou nosso relacionamento. Para deixar de receber outras formas de comunicação, você pode se descadastrar por meio de contato conosco, usando os dados da seção “Contate-nos” abaixo.
Gerenciamento de dados pessoais. A Avalara fornece diferentes contas com funcionalidades variadas que dependem do Serviço acessado pelo usuário. A conta da Avalara geralmente permite que você atualize suas configurações de usuário ou perfil, fazendo login no respectivo site ou Serviço com seu usuário e senha. Se você não possui uma conta, mas gostaria de solicitar o gerenciamento dos seus dados, você pode contatar a Avalara usando as informações da seção “Contate-nos” abaixo.
Direitos do titular. Você como titular de dados pessoais pode solicitar o exercício dos direitos previstos na LGPD, em especial aqueles indicados ao seu art. 18, incluindo: confirmação da existência de tratamento, acesso aos dados pessoais; correção e atualização; portabilidade; revogação de consentimento; restrição, oposição ou exclusão; revisão de decisões automatizadas tomadas com base em seus dados; e reclamação à Autoridade Nacional de Proteção de Dados (“ANPD”) nos meios indicados no site da autoridade: ANPD — Português (Brasil) (www.gov.br).
Responderemos sua solicitação em prazo razoável observando o disposto na legislação aplicável. Poderemos solicitar a comprovação de sua identidade e/ou de seu procurador para que possamos garantir o correto exercício dos seus direitos. Se você for um funcionário de um cliente da Avalara, você também pode entrar em contato com o administrador do sistema na sua empresa para ajuda a gerenciar os seus dados.
Transferência Internacional de Dados Pessoais
A Avalara pode tratar e armazenar os seus dados na sua região ou transferi-los aos Estados Unidos, ou para outros países em que tenhamos afiliadas, subsidiárias ou prestadores de serviços. Você encontrará uma lista de nossos escritórios globais aqui. Nós podemos transferir dados do Brasil para outros países e, quando o fizermos, observaremos todas as exigências legais e regulatórias sobre transferência internacional de dados pessoais, em especial, aquelas dispostas na LGPD e na Resolução CD/ANPD nº 19.
Segurança da Informação
A Avalara adota medidas técnicas e administrativas de segurança para proteger os dados pessoais que trata, em conformidade com o padrão de mercado. Dentre as medidas de segurança que adotamos estão:
Realização de treinamentos aos colaboradores que possuem acesso a dados pessoais sobre aspectos de proteção de dados.
Controle de aspectos de proteção de dados em contratos celebrados com prestadores de serviço ou terceiros que tratem dados pessoais.
Registro das operações de tratamento de dados pessoais (inventário).
Sistemas de segurança da informação, como antivírus e criptografia.
Prazo do Tratamento dos Dados
Manteremos os dados e informações somente até quando estas forem necessárias ou relevantes para as finalidades descritas nesta Política de Privacidade e conforme a relação contratual firmada com você, ou em caso de períodos pré-determinados por lei, ou seja, quando tivermos uma obrigação ou prerrogativa de retenção fundada em lei ou regulamento.
Em relação especificamente aos Dados de uso e de dispositivo e aos Dados dos nossos aplicativos móveis, estes serão armazenados em ambiente seguro e controlado, por prazo mínimo de 6 (seis) meses, nos termos da Lei 12.965/2014 (“Marco Civil da Internet”), observando o nível de técnica disponível.
Controlador dos Dados
A Avalara atua como a controladora de alguns dos dados pessoais descritos nesta Política de Privacidade. Se você utiliza os Serviços da Avalara por meio de sua empresa ou organização, a Avalara é a operadora dos seus dados e a sua empresa ou organização é a controladora dos dados.
Tratamentos de dados pessoais relacionados à prestação de Serviços pela Avalara em que a Avalara atua como operadora são regulados pelo Termo de Tratamento de Dados Pessoais (DPA), o qual é disponibilizado aos cliente da Avalara no momento da contratação dos Serviços.
Monitoramento de E-Mails Recebidos
Todos os e-mails enviados às contas de e-mail da Avalara serão arquivados e podem ser escaneados pela Avalara e/ou nossos prestadores de serviço externos para detectar e prevenir ameaças aos nossos sistemas, investigar condutas ilegais ou inapropriadas, e/ou eliminar e-mails promocionais não solicitados (“spam”). Se você tiver quaisquer preocupações sobre este processo, por favor, contate-nos.
Mudanças nessa Política de Privacidade
A Avalara se reserva o direito de alterar esta Política de Privacidade. Nós o notificaremos antes da efetivação de quaisquer alterações, quando realizarmos atualizações materiais.
Contate-nos
A Avalara conta com uma Encarregada de Dados Pessoais nomeada: Geraldine Mirabile. Em caso de dúvidas sobre nossas práticas de privacidade, por favor entre em contato com nossa Encarregada pelo canal dataprivacy@avalara.com
Effective May 30th 2025 to June 13th 2025
Download
Table of Contents
Atualizado pela última vez em: 30 de maio de 2025
Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda. está comprometida a proteger a privacidade dos indivíduos cujos dados pessoais nós tratamos (“você” ou “seu”). A Avalara poderá tratar dados pessoais de indivíduos que se cadastrem para utilizar os serviços, aplicativos e programas da Avalara (“Serviços”), visitantes do nosso site, indivíduos que solicitem informações, clientes em potencial, e participantes de eventos. Esta Política de Privacidade descreve como a Avalara e suas subsidiárias e afiliadas (“Avalara” ou “nós”) coletam, usam, e compartilham dados pessoais, bem como as escolhas oferecidas pela Avalara sobre a coleta e utilização de dados pessoais.
Dados Pessoais Tratados
Dados que coletamos de você:
A Avalara coleta dados pessoais diretamente de você, por exemplo, quando você solicita informações sobre um Serviço da Avalara ou envia um e-mail à Avalara, ou das suas interações com nosso site, produtos ou Serviços. Detalhes incluem:
Dados de Contato. Quando você solicita informações sobre nossos Serviços, se registra para um evento ou seminário, baixa conteúdo como artigos, se comunica conosco por e-mail, ou participa de uma conversa ao vivo por chat, podemos coletar seus dados de contato, como seu nome, empresa, endereço, telefone, fax, e endereço de e-mail. Se a sua empresa utiliza os Serviços e nós te fornecemos uma conta, nós podemos coletar o seu nome, endereço de e-mail, e endereço de IP associado, como parte da utilização dos Serviços pela sua empresa.
Criação de conta. Quando você cria uma conta conosco pelo nosso site, nós podemos coletar seus dados de contato e senha.
Dados de cobrança. Quando você adquire Serviços ou registra sua presença em um evento, nós podemos coletar informações de cobrança e pagamento.
Dados de uso e de dispositivo. Quando você usa o nosso site ou nossos Serviços, nós podemos também coletar automaticamente dados sobre o seu dispositivo e sobre o seu uso e atividade no nosso site e nos Serviços. Por exemplo, nós coletamos o tipo de sistema operacional que o seu dispositivo utiliza, endereço de IP, identificadores de dispositivo, tipo de navegador, nome de domínio, horário de acessos, e a duração da visita, bem como outras informações.
Dados dos nossos aplicativos móveis. Quando você usa nossos Serviços móveis, nós podemos coletar suas informações de contato, a localização geográfica do seu dispositivo, as informações de localização geográfica que você fornece aos nossos Serviços e as áreas geográficas derivadas do seu endereço de IP. Nós podemos também coletar informações sobre suas faturas, como endereço, número da fatura, número de certificado de isenção, descrição de itens, quantidades e valores.
Dados de conversa por chat. Quando você inicia uma conversa ao vivo por chat, a Avalara coletará um registro sobre a sua interação com os agentes de conversa por chat da Avalara.
Cookies e Outras Tecnologias. Quando você navega no nosso site, nós podemos usar cookies ou outras tecnologias para coletar dados sobre seu dispositivo e atividade no nosso site. Para mais informações sobre Cookies e Outras Tecnologias que utilizamos, os dados que coletamos e as suas opções, por favor clique aqui.
Dados pessoais coletados de outras fontes:
A Avalara poderá também coletar dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e nós podemos combinar esses dados com os dados que já possuímos sobre você. Por exemplo, podemos coletar dados pessoais de:
Parceiros. A Avalara poderá iniciar atividades conjunta de marketing ou patrocínios a eventos com nossos parceiros e podemos coletar os seus dados pessoais a partir dessas atividades. Nós também podemos permitir que parceiros nos indiquem indivíduos que possam se interessar em saber mais sobre os Serviços da Avalara. Nossos parceiros deverão obter a sua permissão antes de compartilhar os seus dados pessoais conosco.
Prestadores de Serviços. A Avalara também pode contratar terceiros prestadores de serviço que nos auxiliam a compreender como nossos clientes utilizam os Serviços da Avalara.
Como Utilizamos os Seus Dados Pessoais
A Avalara utiliza os seus dados para prestar e melhorar os Serviços que você ou a sua empresa solicitem, para se comunicar com você, e para promover anúncios a você por meio de terceiros revendedores.
Prestando e melhorando os Serviços Avalara. A Avalara usa os seus dados, ou os dados que coletamos quando você usa os nossos Serviços, para operar os nossos Serviços, fornecer os Serviços que você ou sua empresa tenha solicitado, e para melhoria contínua de nossa oferta de Serviços, sistemas internos, site e processos. Nós podemos usar os seus dados para autenticar o seu acesso e o seu uso aos Serviços. Nós também podemos usar os seus dados para detectar e prevenir fraudes, proteger a segurança do nosso site e dos nossos Serviços, e melhorar a segurança dos nossos Serviços.
Nós também podemos utilizar os dados que você forneceu ou coletados por terceiros prestadores de serviços ou parceiros, a nosso pedido, para resolver problemas ou fornecer suporte ao consumidor
Nós também podemos usar os seus dados para planejar e organizar eventos corporativos, incluindo webinars.
Comunicação com você. O site da Avalara permite que você baixe artigos, preencha formulários para mais detalhes sobre os nossos Serviços, e para iniciar conversas pela nossa funcionalidade de chat. Você também pode se registrar para participar de seminários online ou eventos presenciais. Nós usamos essa informação para lhe fornecer o material solicitado, para acompanhar os seus interesses nos Serviços, ou para registrá-lo em um evento. Nós também podemos usar dados pessoais para entender você e as suas preferências, de modo que possamos melhorar a sua experiência e enviar a você informações sobre a Avalara, nossas afiliadas, e nossos parceiros, como informações sobre promoções e eventos.
A Avalara também poderá receber dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e combiná-los com os seus dados que já possuímos. Isso nos ajuda a atualizar, expandir e analisar nossos registros, identificar novos consumidores e criar publicidades customizadas para oferecer produtos e serviços que possam ser do seu interesse.
Se você seguir ou curtir a Avalara em sites de redes sociais de terceiros, nós poderemos ver seu perfil público e poderemos direcionar publicidade a você.
Publicidade. Nós podemos usar os dados coletados via cookies e outras tecnologias para configurar nossa publicidade em outros sites ou para realizar ofertas ou propagandas a você, incluindo para serviços de terceiros, com base nas suas atividades de navegação e interesses. Para mais detalhes, clique aqui. Também podemos usar seus dados de contato enviados quando você baixa algum material disponibilizado em nosso website para enviar informações sobre outros serviços da Avalara.
Porque Compartilhamos Dados Pessoais
Prestadores de Serviço. A Avalara poderá compartilhar seus dados com nossos prestadores de serviço contratados e fornecedores, par que esses prestadores de serviços e fornecedores possam prestar serviços a nosso pedido. Por exemplo, nós usamos plataformas de CRM ou plataformas de análise de dados de terceiros para organizar dados e melhor compreender nossos clientes e clientes em potencial. Esses prestadores de serviço estão autorizados a usar os seus dados apenas conforme o necessário para a prestação dos serviços solicitados a nós. Nós podemos também compartilhar dados pessoais com sites de redes sociais profissionais de terceiros, como o LinkedIn, para nossas atividades de marketing e publicidade nesses sites. A menos que descrito nessa Política de Privacidade, a Avalara não compartilha, vende, aluga, ou comercializa nenhum dado com terceiros para os propósitos promocionais desses terceiros.
Afiliadas e Subsidiárias. Nós podemos compartilhar os seus dados com nossas subsidiárias e afiliadas para prestar os Serviços que você solicitar, tais como para propósitos de suporte ao consumidor, marketing, operação técnica, e gerenciamento de contas. Também podemos compartilhar dados com sociedades que planejam adquirir toda ou parte dos negócios da Avalara.
Parceiros da Avalara. A extensa rede de parceiros da Avalara oferece uma ampla gama de integrações que permitem que nossos Serviços se interconectem com softwares de terceiros. Nós podemos compartilhar os seus dados com esses parceiros para auxiliar nossos clientes em comum. Nós também podemos compartilhar os seus dados com nossos parceiros que copatrocinem eventos que você decida comparecer.
Cobrança. A Avalara utiliza terceiros prestadores de serviços para gerenciar o processamento de cartão de crédito. Esse prestador de serviço não tem permissão para armazenar, reter ou utiliza suas informações de cobrança, exceto para o único propósito de processar compras em cartão de crédito a nosso pedido.
Divulgação Obrigatória. A Avalara se reserva o direito de compartilhar os seus dados se necessário por lei ou para cumprir com procedimento judicial, ordem judicial ou processo legal válido. Nós também podemos divulgar os seus dados para proteger os direitos e propriedade da Avalara, nossos agentes, empregados, parceiros e clientes, incluindo para prevenir ou interromper um ataque nos nossos sistemas ou redes, ou para prevenir spam ou tentativas de fraudar nossos usuários. Por fim, nós também podemos divulgar os seus dados durante uma negociação de fusão, financiamento, aquisição, falência, dissolução, transação ou procedimento envolvendo a venda, transferência, desinvestimento ou divulgação de todo ou de parte de nossos negócios ou ativos a outra empresa.
Como Gerenciar seus Dados Pessoais
Preferências de Comunicação. Se você recebeu comunicação promocional da Avalara por e-mail e deseja se descadastrar de futuras comunicações, você pode clicar no botão “descadastrar”, localizado no final da mensagem de e-mail, ou você pode fazê-lo aqui. Se você se descadastrar das comunicações promocionais, você poderá ainda receber algumas mensagens relacionadas a notificações do Serviço, atualizações dos nossos termos ou Política de Privacidade, ou nosso relacionamento. Para deixar de receber outras formas de comunicação, você pode se descadastrar por meio de contato conosco, usando os dados da seção “Contate-nos” abaixo.
Gerenciamento de dados pessoais. A Avalara fornece diferentes contas com funcionalidades variadas que dependem do Serviço acessado pelo usuário. A conta da Avalara geralmente permite que você atualize suas configurações de usuário ou perfil, fazendo login no respectivo site ou Serviço com seu usuário e senha. Se você não possui uma conta, mas gostaria de solicitar o gerenciamento dos seus dados, você pode contatar a Avalara usando as informações da seção “Contate-nos” abaixo.
Direitos do titular. Você como titular de dados pessoais pode solicitar o exercício dos seguintes direitos: acesso aos dados pessoais; correção e atualização; portabilidade; revogação de consentimento; restrição, oposição ou exclusão; revisão de decisões automatizadas tomadas com base em seus dados; e reclamação à Autoridade Nacional de Proteção de Dados.
Responderemos sua solicitação em prazo razoável observando o disposto na legislação aplicável. Poderemos solicitar a comprovação de sua identidade e/ou de seu procurador para que possamos garantir o correto exercício dos seus direitos. Se você for um funcionário de um cliente da Avalara, você também pode entrar em contato com o administrador do sistema na sua empresa para ajuda a gerenciar os seus dados.
Transferência Internacional de Dados Pessoais
A Avalara pode tratar e armazenar os seus dados na sua região ou transferi-los aos Estados Unidos, ou para outros países em que tenhamos afiliadas, subsidiárias ou prestadores de serviços. Você encontrará uma lista de nossos escritórios globais aqui. Nós podemos transferir dados do Brasil para outros países e, quando o fizermos, utilizaremos os mecanismos legais como contratos para garantir que há um mecanismo de transferência adequado.
Segurança da Informação
A Avalara adota medidas técnicas e administrativas de segurança para proteger os dados pessoais que trata, em conformidade com o padrão de mercado. Dentre as medidas de segurança que adotamos estão:
Realização de treinamentos aos colaboradores que possuem acesso a dados pessoais sobre aspectos de proteção de dados.
Controle de aspectos de proteção de dados em contratos celebrados com prestadores de serviço ou terceiros que tratem dados pessoais.
Registro das operações de tratamento de dados pessoais (inventário).
Sistemas de segurança da informação, como antivírus e criptografia.
Prazo do Tratamento dos Dados
Manteremos os dados e informações somente até quando estas forem necessárias ou relevantes para as finalidades descritas nesta Política de Privacidade e conforme a relação contratual firmada com você, ou em caso de períodos pré-determinados por lei, ou seja, quando tivermos uma obrigação ou prerrogativa de retenção fundada em lei ou regulamento.
Controlador dos Dados
A Avalara atua como a controladora de alguns dos dados pessoais descritos nesta Política de Privacidade. Se você utiliza os Serviços da Avalara por meio de sua empresa ou organização, a Avalara é a operadora dos seus dados e a sua empresa ou organização é a controladora dos dados.
Tratamentos de dados pessoais relacionados à prestação de Serviços pela Avalara em que a Avalara atua como operadora são regulados pelo Termo de Tratamento de Dados Pessoais (DPA), o qual é disponibilizado aos cliente da Avalara no momento da contratação dos Serviços.
Monitoramento de E-Mails Recebidos
Todos os e-mails enviados às contas de e-mail da Avalara serão arquivados e podem ser escaneados pela Avalara e/ou nossos prestadores de serviço externos para detectar e prevenir ameaças aos nossos sistemas, investigar condutas ilegais ou inapropriadas, e/ou eliminar e-mails promocionais não solicitados (“spam”). Se você tiver quaisquer preocupações sobre este processo, por favor, contate-nos.
Mudanças nessa Política de Privacidade
A Avalara se reserva o direito de alterar esta Política de Privacidade. Nós o notificaremos antes da efetivação de quaisquer alterações, quando realizarmos atualizações materiais.
Contate-nos
A Avalara conta com uma Encarregada de Dados Pessoais nomeada: Geraldine Mirabile.
Em caso de dúvidas sobre nossas práticas de privacidade, por favor entre em contato com nossa Encarregada pelo canal dataprivacy@avalara.com.
Effective May 30th 2025 to May 30th 2025
Download
Table of Contents
Atualizado pela última vez em: 30 de maio de 2025
Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda. está comprometida a proteger a privacidade dos indivíduos cujos dados pessoais nós tratamos (“você” ou “seu”). A Avalara poderá tratar dados pessoais de indivíduos que se cadastrem para utilizar os serviços, aplicativos e programas da Avalara (“Serviços”), visitantes do nosso site, indivíduos que solicitem informações, clientes em potencial, e participantes de eventos. Esta Política de Privacidade descreve como a Avalara e suas subsidiárias e afiliadas (“Avalara” ou “nós”) coletam, usam, e compartilham dados pessoais, bem como as escolhas oferecidas pela Avalara sobre a coleta e utilização de dados pessoais.
Dados Pessoais Tratados
Dados que coletamos de você:
A Avalara coleta dados pessoais diretamente de você, por exemplo, quando você solicita informações sobre um Serviço da Avalara ou envia um e-mail à Avalara, ou das suas interações com nosso site, produtos ou Serviços. Detalhes incluem:
Dados de Contato. Quando você solicita informações sobre nossos Serviços, se registra para um evento ou seminário, baixa conteúdo como artigos, se comunica conosco por e-mail, ou participa de uma conversa ao vivo por chat, podemos coletar seus dados de contato, como seu nome, empresa, endereço, telefone, fax, e endereço de e-mail. Se a sua empresa utiliza os Serviços e nós te fornecemos uma conta, nós podemos coletar o seu nome, endereço de e-mail, e endereço de IP associado, como parte da utilização dos Serviços pela sua empresa.
Criação de conta. Quando você cria uma conta conosco pelo nosso site, nós podemos coletar seus dados de contato e senha.
Dados de cobrança. Quando você adquire Serviços ou registra sua presença em um evento, nós podemos coletar informações de cobrança e pagamento.
Dados de uso e de dispositivo. Quando você usa o nosso site ou nossos Serviços, nós podemos também coletar automaticamente dados sobre o seu dispositivo e sobre o seu uso e atividade no nosso site e nos Serviços. Por exemplo, nós coletamos o tipo de sistema operacional que o seu dispositivo utiliza, endereço de IP, identificadores de dispositivo, tipo de navegador, nome de domínio, horário de acessos, e a duração da visita, bem como outras informações.
Dados dos nossos aplicativos móveis. Quando você usa nossos Serviços móveis, nós podemos coletar suas informações de contato, a localização geográfica do seu dispositivo, as informações de localização geográfica que você fornece aos nossos Serviços e as áreas geográficas derivadas do seu endereço de IP. Nós podemos também coletar informações sobre suas faturas, como endereço, número da fatura, número de certificado de isenção, descrição de itens, quantidades e valores.
Dados de conversa por chat. Quando você inicia uma conversa ao vivo por chat, a Avalara coletará um registro sobre a sua interação com os agentes de conversa por chat da Avalara.
Cookies e Outras Tecnologias. Quando você navega no nosso site, nós podemos usar cookies ou outras tecnologias para coletar dados sobre seu dispositivo e atividade no nosso site. Para mais informações sobre Cookies e Outras Tecnologias que utilizamos, os dados que coletamos e as suas opções, por favor clique aqui.
Dados pessoais coletados de outras fontes:
A Avalara poderá também coletar dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e nós podemos combinar esses dados com os dados que já possuímos sobre você. Por exemplo, podemos coletar dados pessoais de:
Parceiros. A Avalara poderá iniciar atividades conjunta de marketing ou patrocínios a eventos com nossos parceiros e podemos coletar os seus dados pessoais a partir dessas atividades. Nós também podemos permitir que parceiros nos indiquem indivíduos que possam se interessar em saber mais sobre os Serviços da Avalara. Nossos parceiros deverão obter a sua permissão antes de compartilhar os seus dados pessoais conosco.
Prestadores de Serviços. A Avalara também pode contratar terceiros prestadores de serviço que nos auxiliam a compreender como nossos clientes utilizam os Serviços da Avalara.
Como Utilizamos os Seus Dados Pessoais
A Avalara utiliza os seus dados para prestar e melhorar os Serviços que você ou a sua empresa solicitem, para se comunicar com você, e para promover anúncios a você por meio de terceiros revendedores.
Prestando e melhorando os Serviços Avalara. A Avalara usa os seus dados, ou os dados que coletamos quando você usa os nossos Serviços, para operar os nossos Serviços, fornecer os Serviços que você ou sua empresa tenha solicitado, e para melhoria contínua de nossa oferta de Serviços, sistemas internos, site e processos. Nós podemos usar os seus dados para autenticar o seu acesso e o seu uso aos Serviços. Nós também podemos usar os seus dados para detectar e prevenir fraudes, proteger a segurança do nosso site e dos nossos Serviços, e melhorar a segurança dos nossos Serviços.
Nós também podemos utilizar os dados que você forneceu ou coletados por terceiros prestadores de serviços ou parceiros, a nosso pedido, para resolver problemas ou fornecer suporte ao consumidor
Nós também podemos usar os seus dados para planejar e organizar eventos corporativos, incluindo webinars.
Comunicação com você. O site da Avalara permite que você baixe artigos, preencha formulários para mais detalhes sobre os nossos Serviços, e para iniciar conversas pela nossa funcionalidade de chat. Você também pode se registrar para participar de seminários online ou eventos presenciais. Nós usamos essa informação para lhe fornecer o material solicitado, para acompanhar os seus interesses nos Serviços, ou para registrá-lo em um evento. Nós também podemos usar dados pessoais para entender você e as suas preferências, de modo que possamos melhorar a sua experiência e enviar a você informações sobre a Avalara, nossas afiliadas, e nossos parceiros, como informações sobre promoções e eventos.
A Avalara também poderá receber dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e combiná-los com os seus dados que já possuímos. Isso nos ajuda a atualizar, expandir e analisar nossos registros, identificar novos consumidores e criar publicidades customizadas para oferecer produtos e serviços que possam ser do seu interesse.
Se você seguir ou curtir a Avalara em sites de redes sociais de terceiros, nós poderemos ver seu perfil público e poderemos direcionar publicidade a você.
Publicidade. Nós podemos usar os dados coletados via cookies e outras tecnologias para configurar nossa publicidade em outros sites ou para realizar ofertas ou propagandas a você, incluindo para serviços de terceiros, com base nas suas atividades de navegação e interesses. Para mais detalhes, clique aqui. Também podemos usar seus dados de contato enviados quando você baixa algum material disponibilizado em nosso website para enviar informações sobre outros serviços da Avalara.
Porque Compartilhamos Dados Pessoais
Prestadores de Serviço. A Avalara poderá compartilhar seus dados com nossos prestadores de serviço contratados e fornecedores, par que esses prestadores de serviços e fornecedores possam prestar serviços a nosso pedido. Por exemplo, nós usamos plataformas de CRM ou plataformas de análise de dados de terceiros para organizar dados e melhor compreender nossos clientes e clientes em potencial. Esses prestadores de serviço estão autorizados a usar os seus dados apenas conforme o necessário para a prestação dos serviços solicitados a nós. Nós podemos também compartilhar dados pessoais com sites de redes sociais profissionais de terceiros, como o LinkedIn, para nossas atividades de marketing e publicidade nesses sites. A menos que descrito nessa Política de Privacidade, a Avalara não compartilha, vende, aluga, ou comercializa nenhum dado com terceiros para os propósitos promocionais desses terceiros.
Afiliadas e Subsidiárias. Nós podemos compartilhar os seus dados com nossas subsidiárias e afiliadas para prestar os Serviços que você solicitar, tais como para propósitos de suporte ao consumidor, marketing, operação técnica, e gerenciamento de contas. Também podemos compartilhar dados com sociedades que planejam adquirir toda ou parte dos negócios da Avalara.
Parceiros da Avalara. A extensa rede de parceiros da Avalara oferece uma ampla gama de integrações que permitem que nossos Serviços se interconectem com softwares de terceiros. Nós podemos compartilhar os seus dados com esses parceiros para auxiliar nossos clientes em comum. Nós também podemos compartilhar os seus dados com nossos parceiros que copatrocinem eventos que você decida comparecer.
Cobrança. A Avalara utiliza terceiros prestadores de serviços para gerenciar o processamento de cartão de crédito. Esse prestador de serviço não tem permissão para armazenar, reter ou utiliza suas informações de cobrança, exceto para o único propósito de processar compras em cartão de crédito a nosso pedido.
Divulgação Obrigatória. A Avalara se reserva o direito de compartilhar os seus dados se necessário por lei ou para cumprir com procedimento judicial, ordem judicial ou processo legal válido. Nós também podemos divulgar os seus dados para proteger os direitos e propriedade da Avalara, nossos agentes, empregados, parceiros e clientes, incluindo para prevenir ou interromper um ataque nos nossos sistemas ou redes, ou para prevenir spam ou tentativas de fraudar nossos usuários. Por fim, nós também podemos divulgar os seus dados durante uma negociação de fusão, financiamento, aquisição, falência, dissolução, transação ou procedimento envolvendo a venda, transferência, desinvestimento ou divulgação de todo ou de parte de nossos negócios ou ativos a outra empresa.
Como Gerenciar seus Dados Pessoais
Preferências de Comunicação. Se você recebeu comunicação promocional da Avalara por e-mail e deseja se descadastrar de futuras comunicações, você pode clicar no botão “descadastrar”, localizado no final da mensagem de e-mail, ou você pode fazê-lo aqui. Se você se descadastrar das comunicações promocionais, você poderá ainda receber algumas mensagens relacionadas a notificações do Serviço, atualizações dos nossos termos ou Política de Privacidade, ou nosso relacionamento. Para deixar de receber outras formas de comunicação, você pode se descadastrar por meio de contato conosco, usando os dados da seção “Contate-nos” abaixo.
Gerenciamento de dados pessoais. A Avalara fornece diferentes contas com funcionalidades variadas que dependem do Serviço acessado pelo usuário. A conta da Avalara geralmente permite que você atualize suas configurações de usuário ou perfil, fazendo login no respectivo site ou Serviço com seu usuário e senha. Se você não possui uma conta, mas gostaria de solicitar o gerenciamento dos seus dados, você pode contatar a Avalara usando as informações da seção “Contate-nos” abaixo.
Direitos do titular. Você como titular de dados pessoais pode solicitar o exercício dos seguintes direitos: acesso aos dados pessoais; correção e atualização; portabilidade; revogação de consentimento; restrição, oposição ou exclusão; revisão de decisões automatizadas tomadas com base em seus dados; e reclamação à Autoridade Nacional de Proteção de Dados.
Responderemos sua solicitação em prazo razoável observando o disposto na legislação aplicável. Poderemos solicitar a comprovação de sua identidade e/ou de seu procurador para que possamos garantir o correto exercício dos seus direitos. Se você for um funcionário de um cliente da Avalara, você também pode entrar em contato com o administrador do sistema na sua empresa para ajuda a gerenciar os seus dados.
Transferência Internacional de Dados Pessoais
A Avalara pode tratar e armazenar os seus dados na sua região ou transferi-los aos Estados Unidos, ou para outros países em que tenhamos afiliadas, subsidiárias ou prestadores de serviços. Você encontrará uma lista de nossos escritórios globais aqui. Nós podemos transferir dados do Brasil para outros países e, quando o fizermos, utilizaremos os mecanismos legais como contratos para garantir que há um mecanismo de transferência adequado.
Segurança da Informação
A Avalara adota medidas técnicas e administrativas de segurança para proteger os dados pessoais que trata, em conformidade com o padrão de mercado. Dentre as medidas de segurança que adotamos estão:
Realização de treinamentos aos colaboradores que possuem acesso a dados pessoais sobre aspectos de proteção de dados.
Controle de aspectos de proteção de dados em contratos celebrados com prestadores de serviço ou terceiros que tratem dados pessoais.
Registro das operações de tratamento de dados pessoais (inventário).
Sistemas de segurança da informação, como antivírus e criptografia.
Prazo do Tratamento dos Dados
Manteremos os dados e informações somente até quando estas forem necessárias ou relevantes para as finalidades descritas nesta Política de Privacidade e conforme a relação contratual firmada com você, ou em caso de períodos pré-determinados por lei, ou seja, quando tivermos uma obrigação ou prerrogativa de retenção fundada em lei ou regulamento.
Controlador dos Dados
A Avalara atua como a controladora de alguns dos dados pessoais descritos nesta Política de Privacidade. Se você utiliza os Serviços da Avalara por meio de sua empresa ou organização, a Avalara é a operadora dos seus dados e a sua empresa ou organização é a controladora dos dados.
Tratamentos de dados pessoais relacionados à prestação de Serviços pela Avalara em que a Avalara atua como operadora são regulados pelo Termo de Tratamento de Dados Pessoais (DPA), o qual é disponibilizado aos cliente da Avalara no momento da contratação dos Serviços.
Monitoramento de E-Mails Recebidos
Todos os e-mails enviados às contas de e-mail da Avalara serão arquivados e podem ser escaneados pela Avalara e/ou nossos prestadores de serviço externos para detectar e prevenir ameaças aos nossos sistemas, investigar condutas ilegais ou inapropriadas, e/ou eliminar e-mails promocionais não solicitados (“spam”). Se você tiver quaisquer preocupações sobre este processo, por favor, contate-nos.
Mudanças nessa Política de Privacidade
A Avalara se reserva o direito de alterar esta Política de Privacidade. Nós o notificaremos antes da efetivação de quaisquer alterações, quando realizarmos atualizações materiais.
Contate-nos
A Avalara conta com uma Encarregada de Dados Pessoais nomeada: Geraldine Mirabile.
Em caso de dúvidas sobre nossas práticas de privacidade, por favor entre em contato com nosso Encarregado pelo canal dataprivacy@avalara.com.
Effective May 8th 2023 to May 30th 2025
Download
Table of Contents
Atualizado pela última vez em: 8 de maio de 2023
Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda. está comprometida a proteger a privacidade dos indivíduos cujos dados pessoais nós tratamos (“você” ou “seu”). A Avalara poderá tratar dados pessoais de indivíduos que se cadastrem para utilizar os serviços, aplicativos e programas da Avalara (“Serviços”), visitantes do nosso site, indivíduos que solicitem informações, clientes em potencial, e participantes de eventos. Esta Política de Privacidade descreve como a Avalara e suas subsidiárias e afiliadas (“Avalara” ou “nós”) coletam, usam, e compartilham dados pessoais, bem como as escolhas oferecidas pela Avalara sobre a coleta e utilização de dados pessoais.
Dados Pessoais Tratados
Dados que coletamos de você:
A Avalara coleta dados pessoais diretamente de você, por exemplo, quando você solicita informações sobre um Serviço da Avalara ou envia um e-mail à Avalara, ou das suas interações com nosso site, produtos ou Serviços. Detalhes incluem:
Dados de Contato. Quando você solicita informações sobre nossos Serviços, se registra para um evento ou seminário, baixa conteúdo como artigos, se comunica conosco por e-mail, ou participa de uma conversa ao vivo por chat, podemos coletar seus dados de contato, como seu nome, empresa, endereço, telefone, fax, e endereço de e-mail. Se a sua empresa utiliza os Serviços e nós te fornecemos uma conta, nós podemos coletar o seu nome, endereço de e-mail, e endereço de IP associado, como parte da utilização dos Serviços pela sua empresa.
Criação de conta. Quando você cria uma conta conosco pelo nosso site, nós podemos coletar seus dados de contato e senha.
Dados de cobrança. Quando você adquire Serviços ou registra sua presença em um evento, nós podemos coletar informações de cobrança e pagamento.
Dados de uso e de dispositivo. Quando você usa o nosso site ou nossos Serviços, nós podemos também coletar automaticamente dados sobre o seu dispositivo e sobre o seu uso e atividade no nosso site e nos Serviços. Por exemplo, nós coletamos o tipo de sistema operacional que o seu dispositivo utiliza, endereço de IP, identificadores de dispositivo, tipo de navegador, nome de domínio, horário de acessos, e a duração da visita, bem como outras informações.
Dados dos nossos aplicativos móveis. Quando você usa nossos Serviços móveis, nós podemos coletar suas informações de contato, a localização geográfica do seu dispositivo, as informações de localização geográfica que você fornece aos nossos Serviços e as áreas geográficas derivadas do seu endereço de IP. Nós podemos também coletar informações sobre suas faturas, como endereço, número da fatura, número de certificado de isenção, descrição de itens, quantidades e valores.
Dados de conversa por chat. Quando você inicia uma conversa ao vivo por chat, a Avalara coletará um registro sobre a sua interação com os agentes de conversa por chat da Avalara.
Cookies e Outras Tecnologias. Quando você navega no nosso site, nós podemos usar cookies ou outras tecnologias para coletar dados sobre seu dispositivo e atividade no nosso site. Para mais informações sobre Cookies e Outras Tecnologias que utilizamos, os dados que coletamos e as suas opções, por favor clique aqui.
Dados pessoais coletados de outras fontes:
A Avalara poderá também coletar dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e nós podemos combinar esses dados com os dados que já possuímos sobre você. Por exemplo, podemos coletar dados pessoais de:
Parceiros. A Avalara poderá iniciar atividades conjunta de marketing ou patrocínios a eventos com nossos parceiros e podemos coletar os seus dados pessoais a partir dessas atividades. Nós também podemos permitir que parceiros nos indiquem indivíduos que possam se interessar em saber mais sobre os Serviços da Avalara. Nossos parceiros deverão obter a sua permissão antes de compartilhar os seus dados pessoais conosco.
Prestadores de Serviços. A Avalara também pode contratar terceiros prestadores de serviço que nos auxiliam a compreender como nossos clientes utilizam os Serviços da Avalara.
Como Utilizamos os Seus Dados Pessoais
A Avalara utiliza os seus dados para prestar e melhorar os Serviços que você ou a sua empresa solicitem, para se comunicar com você, e para promover anúncios a você por meio de terceiros revendedores.
Prestando e melhorando os Serviços Avalara. A Avalara usa os seus dados, ou os dados que coletamos quando você usa os nossos Serviços, para operar os nossos Serviços, fornecer os Serviços que você ou sua empresa tenha solicitado, e para melhoria contínua de nossa oferta de Serviços, sistemas internos, site e processos. Nós podemos usar os seus dados para autenticar o seu acesso e o seu uso aos Serviços. Nós também podemos usar os seus dados para detectar e prevenir fraudes, proteger a segurança do nosso site e dos nossos Serviços, e melhorar a segurança dos nossos Serviços.
Nós também podemos utilizar os dados que você forneceu ou coletados por terceiros prestadores de serviços ou parceiros, a nosso pedido, para resolver problemas ou fornecer suporte ao consumidor
Nós também podemos usar os seus dados para planejar e organizar eventos corporativos, incluindo webinars.
Comunicação com você. O site da Avalara permite que você baixe artigos, preencha formulários para mais detalhes sobre os nossos Serviços, e para iniciar conversas pela nossa funcionalidade de chat. Você também pode se registrar para participar de seminários online ou eventos presenciais. Nós usamos essa informação para lhe fornecer o material solicitado, para acompanhar os seus interesses nos Serviços, ou para registrá-lo em um evento. Nós também podemos usar dados pessoais para entender você e as suas preferências, de modo que possamos melhorar a sua experiência e enviar a você informações sobre a Avalara, nossas afiliadas, e nossos parceiros, como informações sobre promoções e eventos.
A Avalara também poderá receber dados pessoais de outras fontes, incluindo terceiros de quem tenhamos adquirido dados, e combiná-los com os seus dados que já possuímos. Isso nos ajuda a atualizar, expandir e analisar nossos registros, identificar novos consumidores e criar publicidades customizadas para oferecer produtos e serviços que possam ser do seu interesse.
Se você seguir ou curtir a Avalara em sites de redes sociais de terceiros, nós poderemos ver seu perfil público e poderemos direcionar publicidade a você.
Publicidade. Nós podemos usar os dados coletados via cookies e outras tecnologias para configurar nossa publicidade em outros sites ou para realizar ofertas ou propagandas a você, incluindo para serviços de terceiros, com base nas suas atividades de navegação e interesses. Para mais detalhes, clique aqui. Também podemos usar seus dados de contato enviados quando você baixa algum material disponibilizado em nosso website para enviar informações sobre outros serviços da Avalara.
Porque Compartilhamos Dados Pessoais
Prestadores de Serviço. A Avalara poderá compartilhar seus dados com nossos prestadores de serviço contratados e fornecedores, par que esses prestadores de serviços e fornecedores possam prestar serviços a nosso pedido. Por exemplo, nós usamos plataformas de CRM ou plataformas de análise de dados de terceiros para organizar dados e melhor compreender nossos clientes e clientes em potencial. Esses prestadores de serviço estão autorizados a usar os seus dados apenas conforme o necessário para a prestação dos serviços solicitados a nós. Nós podemos também compartilhar dados pessoais com sites de redes sociais profissionais de terceiros, como o LinkedIn, para nossas atividades de marketing e publicidade nesses sites. A menos que descrito nessa Política de Privacidade, a Avalara não compartilha, vende, aluga, ou comercializa nenhum dado com terceiros para os propósitos promocionais desses terceiros.
Afiliadas e Subsidiárias. Nós podemos compartilhar os seus dados com nossas subsidiárias e afiliadas para prestar os Serviços que você solicitar, tais como para propósitos de suporte ao consumidor, marketing, operação técnica, e gerenciamento de contas. Também podemos compartilhar dados com sociedades que planejam adquirir toda ou parte dos negócios da Avalara.
Parceiros da Avalara. A extensa rede de parceiros da Avalara oferece uma ampla gama de integrações que permitem que nossos Serviços se interconectem com softwares de terceiros. Nós podemos compartilhar os seus dados com esses parceiros para auxiliar nossos clientes em comum. Nós também podemos compartilhar os seus dados com nossos parceiros que copatrocinem eventos que você decida comparecer.
Cobrança. A Avalara utiliza terceiros prestadores de serviços para gerenciar o processamento de cartão de crédito. Esse prestador de serviço não tem permissão para armazenar, reter ou utiliza suas informações de cobrança, exceto para o único propósito de processar compras em cartão de crédito a nosso pedido.
Divulgação Obrigatória. A Avalara se reserva o direito de compartilhar os seus dados se necessário por lei ou para cumprir com procedimento judicial, ordem judicial ou processo legal válido. Nós também podemos divulgar os seus dados para proteger os direitos e propriedade da Avalara, nossos agentes, empregados, parceiros e clientes, incluindo para prevenir ou interromper um ataque nos nossos sistemas ou redes, ou para prevenir spam ou tentativas de fraudar nossos usuários. Por fim, nós também podemos divulgar os seus dados durante uma negociação de fusão, financiamento, aquisição, falência, dissolução, transação ou procedimento envolvendo a venda, transferência, desinvestimento ou divulgação de todo ou de parte de nossos negócios ou ativos a outra empresa.
Como Gerenciar seus Dados Pessoais
Preferências de Comunicação. Se você recebeu comunicação promocional da Avalara por e-mail e deseja se descadastrar de futuras comunicações, você pode clicar no botão “descadastrar”, localizado no final da mensagem de e-mail, ou você pode fazê-lo aqui. Se você se descadastrar das comunicações promocionais, você poderá ainda receber algumas mensagens relacionadas a notificações do Serviço, atualizações dos nossos termos ou Política de Privacidade, ou nosso relacionamento. Para deixar de receber outras formas de comunicação, você pode se descadastrar por meio de contato conosco, usando os dados da seção “Contate-nos” abaixo.
Gerenciamento de dados pessoais. A Avalara fornece diferentes contas com funcionalidades variadas que dependem do Serviço acessado pelo usuário. A conta da Avalara geralmente permite que você atualize suas configurações de usuário ou perfil, fazendo login no respectivo site ou Serviço com seu usuário e senha. Se você não possui uma conta, mas gostaria de solicitar o gerenciamento dos seus dados, você pode contatar a Avalara usando as informações da seção “Contate-nos” abaixo.
Direitos do titular. Você como titular de dados pessoais pode solicitar o exercício dos seguintes direitos: acesso aos dados pessoais; correção e atualização; portabilidade; revogação de consentimento; restrição, oposição ou exclusão; revisão de decisões automatizadas tomadas com base em seus dados; e reclamação à Autoridade Nacional de Proteção de Dados.
Responderemos sua solicitação em prazo razoável observando o disposto na legislação aplicável. Poderemos solicitar a comprovação de sua identidade e/ou de seu procurador para que possamos garantir o correto exercício dos seus direitos. Se você for um funcionário de um cliente da Avalara, você também pode entrar em contato com o administrador do sistema na sua empresa para ajuda a gerenciar os seus dados.
Transferência Internacional de Dados Pessoais
A Avalara pode tratar e armazenar os seus dados na sua região ou transferi-los aos Estados Unidos, ou para outros países em que tenhamos afiliadas, subsidiárias ou prestadores de serviços. Você encontrará uma lista de nossos escritórios globais aqui. Nós podemos transferir dados do Brasil para outros países e, quando o fizermos, utilizaremos os mecanismos legais como contratos para garantir que há um mecanismo de transferência adequado.
Segurança da Informação
A Avalara adota medidas técnicas e administrativas de segurança para proteger os dados pessoais que trata, em conformidade com o padrão de mercado. Dentre as medidas de segurança que adotamos estão:
Realização de treinamentos aos colaboradores que possuem acesso a dados pessoais sobre aspectos de proteção de dados.
Controle de aspectos de proteção de dados em contratos celebrados com prestadores de serviço ou terceiros que tratem dados pessoais.
Registro das operações de tratamento de dados pessoais (inventário).
Sistemas de segurança da informação, como antivírus e criptografia.
Prazo do Tratamento dos Dados
Manteremos os dados e informações somente até quando estas forem necessárias ou relevantes para as finalidades descritas nesta Política de Privacidade e conforme a relação contratual firmada com você, ou em caso de períodos pré-determinados por lei, ou seja, quando tivermos uma obrigação ou prerrogativa de retenção fundada em lei ou regulamento.
Controlador dos Dados
A Avalara atua como a controladora de alguns dos dados pessoais descritos nesta Política de Privacidade. Se você utiliza os Serviços da Avalara por meio de sua empresa ou organização, a Avalara é a operadora dos seus dados e a sua empresa ou organização é a controladora dos dados.
Tratamentos de dados pessoais relacionados à prestação de Serviços pela Avalara em que a Avalara atua como operadora são regulados pelo Termo de Tratamento de Dados Pessoais (DPA), o qual é disponibilizado aos cliente da Avalara no momento da contratação dos Serviços.
Monitoramento de E-Mails Recebidos
Todos os e-mails enviados às contas de e-mail da Avalara serão arquivados e podem ser escaneados pela Avalara e/ou nossos prestadores de serviço externos para detectar e prevenir ameaças aos nossos sistemas, investigar condutas ilegais ou inapropriadas, e/ou eliminar e-mails promocionais não solicitados (“spam”). Se você tiver quaisquer preocupações sobre este processo, por favor, contate-nos.
Mudanças nessa Política de Privacidade
A Avalara se reserva o direito de alterar esta Política de Privacidade. Nós o notificaremos antes da efetivação de quaisquer alterações, quando realizarmos atualizações materiais.
Contate-nos
Se você tiver quaisquer questões ou reclamações a respeito dessa Política de Privacidade, por favor envie um e-mail para dataprivacy@avalara.com.
Australia Privacy Notice
Version
Effective October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the
extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the
extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Australia Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behaviour and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behaviour and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behaviour. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Datasection below.For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may, to the extent permitted by applicable law but not otherwise, collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may, to the extent permitted by applicable law, use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you. Personal information will only be used in such circumstances if the third party source has the lawful authority to provide that information to us.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. For the avoidance of doubt, we will only advertise to you if and to the extent permitted by applicable law.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place. The recipient of your personal information in another country may in some cases not be required to handle that information in accordance with the data protection laws of your jurisdiction, although they may be subject to data protection laws of their own jurisdiction.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behaviour, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
India Privacy Policy
Version
Effective November 14th 2025
Download
Table of Contents
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights. California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data. Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller. Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails. All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice. Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password.
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information.
To process payments for services.
Facilitating purchase of services.
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
To provide more customized services.
To troubleshoot or provide customer support.
Customisations to service and troubleshooting.
Information collected through cookies.
To understand user usage of website and personalise and improve our services.
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements.
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Effective November 3rd 2025 to November 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights. California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data. Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller. Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails. All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice. Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password.
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information.
To process payments for services.
Facilitating purchase of services.
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
To provide more customized services.
To troubleshoot or provide customer support.
Customisations to service and troubleshooting.
Information collected through cookies.
To understand user usage of website and personalise and improve our services.
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements.
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Effective October 15th 2025 to November 3rd 2025
Download
Table of Contents
Last Updated: October 14, 2025
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights. California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data. Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller. Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails. All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice. Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password.
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information.
To process payments for services.
Facilitating purchase of services.
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
To provide more customized services.
To troubleshoot or provide customer support.
Customisations to service and troubleshooting.
Information collected through cookies.
To understand user usage of website and personalise and improve our services.
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements.
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Consent:
[By clicking on the 'I Agree' button / ticking this checkbox], you hereby acknowledge that you have read, understood and consent to the processing (including collection, storing, disclosure, transfer, sharing) of your personal data for the purposes set out in this Privacy Notice.
Effective October 14th 2025 to October 15th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights. California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data. Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller. Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails. All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice. Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information
To process payments for services
Facilitating purchase of services
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts [Avalara to populate]
To provide more customized services
To troubleshoot or provide customer support.
Customisations to service and troubleshooting
Information collected through cookies, namely [Avalara to populate]
To understand user usage of website and personalise and improve our services
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Consent:
[By clicking on the 'I Agree' button / ticking this checkbox], you hereby acknowledge that you have read, understood and consent to the processing (including collection, storing, disclosure, transfer, sharing) of your personal data for the purposes set out in this Privacy Notice.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information
To process payments for services
Facilitating purchase of services
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts [Avalara to populate]
To provide more customized services
To troubleshoot or provide customer support.
Customisations to service and troubleshooting
Information collected through cookies, namely [Avalara to populate]
To understand user usage of website and personalise and improve our services
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Consent:
[By clicking on the 'I Agree' button / ticking this checkbox], you hereby acknowledge that you have read, understood and consent to the processing (including collection, storing, disclosure, transfer, sharing) of your personal data for the purposes set out in this Privacy Notice.
Effective October 14th 2025 to October 14th 2025
Download
Table of Contents
Last Updated: October 14, 2025
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your"). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies Avalara Technologies Private Limited, with its registered address at LVS Arcade, Plot No 71, Jubilee Enclave, Hyderabad, and Avalara Europe Limited, with its registered address at Lanchester House, Trafalgar Place, Brighton, BN1 4FU (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
Personal Data Collected
Data collected from you: Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address. If your company uses the Services and we provision you an account, we may collect your name, email address, and associated IP address as part of your company's use of the Services.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing data. When you purchase Services or register to attend an event, we may collect billing and payment information.
Device and usage data. When you use our website or our Services, we may also automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, and other information.
Data from our mobile apps. When you use our mobile Services, we may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address. We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts.
Chat data. When you start a live chat, Avalara will collect a log about your interaction with Avalara’s chat agents.
Cookies and Other Technologies. When you navigate our website, we may use cookies or other technologies to collect data about your device and activity on our website. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. For example, we may collect personal data from:
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
How We Use Your Personal Data:
Avalara uses your data to provide you with and improve upon the Services that you or your company requests, to communicate with you, and to advertise to you through third party publishers.
Providing and Improving Avalara’s Services. Avalara uses the data you provide, or data that we collect when you use our Services, to operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes. We may use your data to authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
We may also use data provided by you or collected by third party service providers or partners on our behalf to troubleshoot or provide customer support.
We may also use your data to plan and host corporate events, including online webinars.
Communicating with you. Avalara’s website allows you to download white papers, fill out forms for more details about our Services, and to engage with us via our chat functionality. You can also register to attend online seminars or in-person events. We use this information to provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request. We may also use personal data to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
If you follow or like Avalara on third party social media sites, we can see your public profile and may direct advertising to you.
Advertising. We may use data collected via cookies and other technologies to manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Legal bases for processing (EEA and UK users). We collect and process information about users based in the European Economic Area (“EEA”) and the United Kingdom (“UK”) where we have a basis to do so under applicable law. Avalara relies on one of the following four legal bases for processing your data:
Contract. When you or your company enter into an agreement with us, we will process your data to fulfill the terms of our contract.
Legitimate interest. We have a legitimate interest in protecting the safety and security of our Services, operating and improving the Services, supporting our customers, marketing and promoting the Services, and protecting our interests.
Consent. In some cases, you will give us consent to use your data for a specific purpose.
Legal obligation. We may be required to process your data to comply with a legal obligation.
EEA and UK users have a number of rights in relation to their personal data processed by Avalara. Individuals residing in the EEA or the UK can review a summary of those rights here.
Why We Share Personal Data
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us. We may also share personal data with third-party social networking websites, like LinkedIn, for our marketing and advertising on those websites. Unless described in this Privacy Notice, Avalara does not share, sell, rent, or trade any data with third parties for their promotional purposes.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Billing. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
Compelled Disclosure. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
How to Manage Your Personal Data
Communication Preferences. If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data. Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
California Privacy Rights
California residents can review Avalara’s California Consumer Privacy Act disclosures here.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice in accordance with applicable law. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Notwithstanding anything to the contrary contained in the Privacy Notice, the following additional provisions will apply to personal data related to persons in India. In case of conflicts between anything else mentioned above and these additional provisions pertaining to India, the latter shall prevail:
Personal Data Collected:
Category of personal data
Purpose
Service enabled through data processing
Identifiers such as name, email address, password
Create and manage user accounts, facilitate login, enable communication, and provide support.
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To authenticate your ability to access and use the Services. We also use your data to detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
Account creation, login, account management, service-related communications.
Payment information
To process payments for services
Facilitating purchase of services
Device information, namely operating system type, IP address, device identifiers, browser type, device type, domain name, access times, and the duration of visit, information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts [Avalara to populate]
To provide more customized services
To troubleshoot or provide customer support.
Customisations to service and troubleshooting
Information collected through cookies, namely [Avalara to populate]
To understand user usage of website and personalise and improve our services
To understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To manage our advertising on other sites or to provide you offers or advertisements, including for third-party services, based upon your browsing activities and interests. For more details, please click here.
Service improvements
Legal bases for processing (India). We collect and process information about users based in the India where we have a basis to do so under applicable law. Avalara relies on one of the following two legal bases for processing your data: consent and certain legitimate uses identified specifically under Indian data protection laws.
India Privacy Rights
You can exercise the following rights with respect to the personal data provided to Avalara pursuant to this Privacy Notice:
Right to access information about personal data: You have the right to obtain a summary of such personal data and the processing Avalara has undertaken in relation to the same. You also have the right to obtain from Avalara (a) the identities of the parties with whom Avalara has shared such personal data along with the description of the personal data shared; and (b) any other information as may be required to be provided to you under applicable law, unless Avalara has shared such personal data with another person who is authorised by law to obtain such personal data for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences, as applicable.
Right to correct and erase personal data: You have the right to correct, complete, update and/or require erasure of your personal data. However, Avalara will not be able to comply with an erasure request if Avalara has to retain such information for the purpose for which it was collected or for complying with legal requirements.
Right to withdraw consent for providing personal data: The provision of your personal data is voluntary and you have the right to withdraw consent to the processing of any personal data held by Avalara. This may however impact the continuation of your relationship with Avalara.
Right to nominate: You have the right to nominate one or more individuals who will exercise your rights in case of your death or incapacity (i.e., inability to exercise statutory rights granted to a data principal due to unsoundness of mind or infirmity of the body.).
Right of grievance redressal: You have the right to contact Avalara to understand Avalara’s practices for processing personal data and Avalara’s obligations in relation to such personal data and/or with regard to your rights in relation to your personal data. We will respond to all verifiable requests within 30 days or such statutory period as may be prescribed under local law or regulations. You may contact our grievance officer using the details set out below in the ‘Contact Us’ section of this Privacy Notice.
Retention of Personal Data
For the purposes of the DPDP Act, the personal data collected by Avalara shall be retained for (a) as long as is necessary for the purposes under this Privacy Notice or (b) if you withdraw your consent provided under this Privacy Notice, or you exercise your right to erasure, whichever is earlier, unless the retention of such personal data or information is required under any other law for the time being in force. Upon the occurrence of point (a) or (b), Avalara will remove the personal data and ensure that any data processors engaged by Avalara with whom personal data is shared also remove such personal data.
Security of Your Personal Data
We use administrative, technical, and physical security measures consistent with legal and regulatory requirements to help protect your personal data. These methods are designed to protect against unlawful or unauthorized destruction, loss, alteration, use or disclosure of, or access to, your personal data.
Consent:
[By clicking on the 'I Agree' button / ticking this checkbox], you hereby acknowledge that you have read, understood and consent to the processing (including collection, storing, disclosure, transfer, sharing) of your personal data for the purposes set out in this Privacy Notice.
Brasil Job Candidate Privacy Notice
Version
Effective August 24th 2026
Download
Table of Contents
AVALARA
AVISO SOBRE O TRATAMENTO DE DADOS PESSOAIS PARA RECRUTAMENTO E INTEGRAÇÃO (ONBOARDING) - BRASIL
Este Aviso descreve as práticas da empresa do Grupo Avalara à qual você está se candidatando (“nós” ou “a Empresa”), na qualidade de controladora de dados, em relação ao tratamento (como coleta, uso, armazenamento, divulgação ou exclusão) de dados pessoais obtidos durante o processo de recrutamento e, caso você seja contratado(a), durante o processo de integração (“Dados Pessoais”). Este Aviso abrange todos os candidatos a emprego da Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda., suas empresas afiliadas e patrocinadores de private equity e empresas afiliadas (coletivamente, “Grupo Avalara”) no Brasil.
I. Categorias de Dados Pessoais
Tratamos Dados Pessoais não sensíveis (“Dados do Candidato”) e, na medida em que você os forneça, determinadas categorias especiais de Dados Pessoais (“Dados Pessoais Sensíveis do Candidato”), conforme exigido e permitido pela legislação aplicável.
Tratamos os seguintes Dados do Candidato:
Nome, endereço, e-mail, número de telefone (“Dados de Contato Básico”);
Passaporte, RG ou CPF, número de inscrição fiscal, nacionalidade, data e local de nascimento, gênero, informações de visto e permissão de trabalho, informações de viagem, dados de despesas, contatos de emergência, número da CNH, informações bancárias para configuração de folha de pagamento, contribuições para planos de saúde e previdência, estado civil, número de filhos e dados semelhantes (“Dados de Recursos Humanos”);
Informações contidas em seu currículo/CV, respostas a perguntas de triagem ou outros envios, histórico educacional, histórico profissional, qualificações, habilidades e experiências, verificações de referências, testes de habilidades, informações de idioma, informações fornecidas ou geradas por entrevistadores, recrutadores e referências (“Dados de Antecedentes/Background”);
Informações sobre seu acesso e uso das instalações e sistemas de computador do Grupo Avalara, como nome de usuário, endereço IP, e-mails e outras comunicações eletrônicas, documentos, arquivos, sites acessados e registros de log, informações de crachá de segurança, imagens e gravações de câmeras (“Dados de Segurança e Controle de Acesso”).
Além disso, tratamos os seguintes Dados Sensíveis do Candidato informados:
Informações sobre deficiência, para que possamos realizar ajustes razoáveis no processo de recrutamento ou no ambiente de trabalho.
Informações ou atestados de saúde (quando exigido por lei).
Filiação sindical (quando legalmente exigido).
Autodeclaração sobre origem racial ou étnica (quando legalmente exigido ou, mediante seu consentimento, para fins de programas de diversidade e inclusão).
II. Finalidades do Tratamento
Tratamos seus Dados Pessoais, conforme permitido ou exigido pela legislação aplicável, para as seguintes finalidades:
Administrar o processo seletivo e avaliar sua adequação à vaga para a qual se candidatou (ou outras vagas), incluindo a criação de dossiê do candidato, gestão da candidatura, realização de avaliações, entrevistas, organização ou reembolso de viagens e hospedagens, coleta de feedback, verificações de antecedentes e triagem; participação em iniciativas de diversidade; análises para compreender o perfil de candidatos; e integração, caso contratado (“Finalidades Relacionadas ao Recrutamento”);
cumprir leis e requisitos trabalhistas aplicáveis e administrar essas obrigações (“Finalidades Regulatórias”);
Facilitar e gerenciar a segurança e o controle de acesso às instalações, equipamentos e sistemas do Grupo Avalara, incluindo atividades de segurança (“Finalidades de Segurança e Controle de Acesso”); e
Apoiar qualquer reivindicação ou defesa que o Grupo Avalara possa enfrentar perante autoridades administrativas, judiciais, arbitrais ou de mediação, e cooperar com autoridades regulatórias ou policiais, conforme exigido por lei (“Finalidades Relacionadas a Litígios”).
III. Base Legal para o Tratamento de Dados Pessoais
A Lei Geral de Proteção de Dados Pessoais (“LGPD”) exige que qualquer tratamento de Dados Pessoais tenha uma base legal. Normalmente, utilizamos as seguintes bases:
Consentimento (art. 7º, I, e art. 11, I, da LGPD); Execução de contrato de trabalho ou procedimentos preliminares (art. 7º, V, e art. 11, II, d); Cumprimento de obrigação legal ou regulatória decorrente da relação de trabalho (art. 7º, II, e art. 11, II, a); Interesse legítimo, quando não prevalecerem seus direitos e liberdades fundamentais (art. 7º, IX).
Em geral, o tratamento dos seus Dados Pessoais é necessário para a análise do contrato de trabalho. De modo geral, é necessário fornecer seus Dados Pessoais para ser considerado(a) para uma vaga na Empresa, exceto em casos específicos em que indicamos que o fornecimento de determinados dados é facultativo.
Nos baseamos nas seguintes justificativas legais para o tratamento dos seus Dados Pessoais:
TRATAMENTO DE DADOS PESSOAIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados de candidatos envolvidas
Base legal
Finalidades relacionadas ao recrutamento
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Consentimento;
Execução de contrato;
Obrigação legal; ou
TRATAMENTO DE DADOS PESSOAIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados de candidatos envolvidas
Base legal
Interesse Legítimo para administrar adequadamente o processo de recrutamento (e, se aplicável, de integração)
Finalidades relacionadas à regulamentação
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Execução de contrato;
Obrigação legal; ou
Interesse Legítimo para administração da relação de trabalho.
Finalidades de segurança e controle de acesso
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Execução de contrato;
Obrigação legal; ou
Interesse Legítimo para facilitar e gerenciar a segurança e os controles de acesso relativos aos escritórios e instalações, equipamentos e sistemas do Grupo Avalara.
Finalidades relacionadas a litígios
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Exercício regular de direitos em processo judicial, administrativo ou arbitral;
Obrigação legal.
Realizamos testes de balanceamento para o tratamento de dados que efetuamos com base em nossos interesses legítimos; mais informações sobre esse processo podem ser obtidas junto ao responsável pela proteção de dados, utilizando os dados de contato publicados. Mais informações sobre o teste de balanceamento estão disponíveis mediante solicitação.
TRATAMENTO DE DADOS PESSOAIS SENSÍVEIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados sensíveis de candidatos envolvidas
Base legal
Finalidades relacionadas ao recrutamento, incluindo integração, iniciativas de monitoramento de igualdade de oportunidades e diversidade, adaptações para pessoas com deficiência e verificação do direito ao trabalho.
Informações sobre deficiência, quando fornecidas voluntariamente.
Outras informações de saúde, quando necessário coletá-las.
Dados sobre origem racial ou étnica, quando fornecidos
Consentimento (LGPD Art. 11(I) ou
Tratamento necessário para finalidade de
(i) cumprimento de obrigações legais ou regulatórias pelo controlador
TRATAMENTO DE DADOS PESSOAIS SENSÍVEIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados sensíveis de candidatos envolvidas
Base legal
voluntariamente ou contidos em seu passaporte ou outros documentos de cidadania e trabalhistas, ou informações coletadas para fins de visto e imigração.
(LGPD Art. 11(II)(a));
Proteção da vida ou da incolumidade física do titular ou de terceiro (ex. em caso de acidente de trabalho) (LGPD Art. 11(II)(e));
Avaliação da capacidade laboral de um trabalhador ou a prestação de cuidados ou tratamento de saúde (LGPD Art. 11(II)(a)).
Finalidades relacionadas à regulamentação
Informações sobre deficiência, quando fornecidas voluntariamente.
Outras informações de saúde, quando necessárias.
Dados sobre raça ou etnia, quando fornecidos voluntariamente ou contidos em seu passaporte ou outros documentos de cidadania e direito ao trabalho, ou informações coletadas para visto e imigração.
Finalidades relacionadas a litígios
Dados sensíveis do candidato relativos a reclamações ou defesas perante qualquer autoridade jurisdicional e/ou administrativa.
Tratamento necessário exercício regular de direitos, inclusive em contrato e em processo judicial, administrativo e arbitral (LGPD Art. 11(II)(d)).
IV. Transferências de dados, destinatários e justificativa legal para tais transferências
Compartilhamos suas informações internamente dentro da Empresa. Além disso, transferimos seus Dados Pessoais, em conformidade com a legislação aplicável, para as entidades do Grupo Avalara e terceiros (por exemplo, prestadores de serviços, autoridades governamentais e consultores externos). Alguns destinatários estão localizados fora do Brasil.
1. Destinatários externos dos seus dados pessoais
Outras empresas do Grupo Avalara: Em alguns casos, é necessário compartilhar os Dados do Candidato coletados localmente dentro do Grupo Avalara. Fazemos isso para facilitar a comunicação interna e a gestão de tarefas com outras empresas do grupo, o planejamento e a administração de RH em todo o grupo, em conexão com a estrutura matricial global do grupo, e para podermos cumprir a relação de trabalho dentro de nossa estrutura global. A base legal para essas transferências é a execução contratual e interesse legítimo, sendo nossos interesses legítimos os mencionados acima. O acesso aos Dados do Candidato é fornecido apenas quando necessário e sujeito a um conceito de acesso.
Em particular, os Dados Pessoais podem ser compartilhados com as seguintes empresas do Grupo Avalara:
Avalara, Inc. (US) e Avalara Europe Ltd. (UK) para os fins mencionados acima, visto que vários gestores seniores e funções de RH das entidades do Grupo Avalara no Espaço Econômico Europeu estão localizados nessas entidades; e
Avalara, Inc. (US), Avalara Europe Ltd. (UK) e outras entidades de serviços compartilhados para a prestação de serviços compartilhados, por exemplo, para hospedagem de dados e serviços de TI, processamento de aplicativos e suporte à integração, gestão de despesas de viagem, suporte e manutenção de TI.
A Avalara, Inc. ou Avalara Europe Ltd. atua como Operadora (conforme descrito abaixo) de alguns Dados Pessoais (por exemplo, hospeda o sistema global de informações de recursos humanos) e como Controladora em relação a outros Dados Pessoais.
Fornecedores de benefícios, seguradoras, consultores profissionais: Fornecedores de benefícios (como processadores de folha de pagamento ou provedores de planos de previdência), seguradoras (como administradoras de planos de saúde e seguradoras de vida) e corretoras, bem como outros prestadores de serviços de RH, também podem receber informações sobre seu salário, benefícios e participação acionária, conforme necessário para cotar, administrar e fornecer remuneração, benefícios e outras gratificações relacionadas ao trabalho, administrar a força de trabalho, cumprir as leis aplicáveis e os requisitos trabalhistas, comunicar-se com você e terceiros, e responder e atender a solicitações e demandas legais. Esses terceiros estão localizados no seu país de emprego e, dependendo da função, no Reino Unido, nos Estados Unidos e em outros países. Na medida em que esses fornecedores não atuem como Operadores (conforme abaixo), a base legal para tal transferência é a execução de contrato e o legítimo interesse.
Prestadores de serviços terceirizados: Determinados prestadores de serviços terceirizados, sejam eles afiliados ou não, receberão seus Dados Pessoais para processá-los sob instruções apropriadas (“Operadores”), conforme necessário para as finalidades do processamento, em particular para realizar verificações de antecedentes profissionais e determinadas atividades globais de gestão de RH ou tarefas relacionadas à TI (ou seja, para hospedagem ou manutenção de sistemas globais seguros ou da plataforma de recrutamento). Os Operadores estarão sujeitos a obrigações contratuais de implementar medidas de segurança técnicas e organizacionais adequadas para proteger seus Dados Pessoais e processá-los somente conforme instruídos. Uma lista dos operadores atualmente em atividade pode ser fornecida mediante solicitação a dataprivacy@avalara.com.
Empregadores anteriores: Podemos fornecer seus dados de candidato a empregadores anteriores para obter as referências e verificações de antecedentes necessárias.
Agências governamentais, órgãos reguladores e consultores profissionais: Poderemos precisar transferir seus Dados Pessoais para agências governamentais e reguladoras (por exemplo, autoridades fiscais, tribunais e autoridades governamentais) para cumprir obrigações legais, e para consultores profissionais externos, conforme necessário para cumprir obrigações legais, comunicar-nos com você e terceiros, responder e atender a solicitações e demandas legais e, de outra forma, atender a interesses legítimos (por exemplo, proteger os interesses legais do Grupo Avalara). Os consultores profissionais podem estar localizados no seu país de emprego ou, dependendo da função, no Reino Unido, nos Estados Unidos e em outros países. A base legal para essa transferência é o cumprimento de obrigação legal e o legítimo interesse.
Dados sensíveis dos candidatos só serão processados e transferidos se permitido pela legislação aplicável.
Potenciais Adquirentes ou Parceiros: Poderemos precisar compartilhar seus Dados Pessoais com empresas ou consultores profissionais de empresas que possam estar interessadas em adquirir a totalidade ou parte da participação ou dos ativos da Avalara, durante um processo de due diligence e negociação. Essas empresas e indivíduos podem estar localizados no Brasil ou no exterior.
Em relação às transferências de dados descritas acima, os Dados Pessoais podem, em alguns casos, ser transferidos para destinatários (i) em um país que possua uma decisão de adequação, (ii) vinculados por cláusulas contratuais padrão ou outro instrumento vinculativo que garanta o mesmo nível de proteção de dados que as cláusulas contratuais padrão, (iii) quando tal transferência for necessária para o estabelecimento, exercício ou defesa de direitos legais no contexto de processos administrativos, regulatórios ou judiciais específicos, (iv) quando for necessário para proteger a vida ou a segurança física do titular dos dados ou de outra pessoa física, (v) você tiver dado consentimento para tal transferência, ou (vi) o destinatário garantir, de outra forma, salvaguardas adequadas.
2. Transferências internacionais de dados
Transferimos Dados Pessoais para empresas do Grupo Avalara, prestadores de serviços, clientes, parceiros comerciais, reguladores e consultores localizados dentro ou fora do Brasil, como a Avalara, Inc. nos Estados Unidos, somente se necessário para os fins listados acima. Na medida em que seus Dados Pessoais sejam transferidos para países que não oferecem um nível adequado de proteção de dados sob a perspectiva da legislação brasileira, basearemos a respectiva transferência em salvaguardas apropriadas, como cláusulas contratuais padrão, quando exigido pela legislação aplicável. Você pode solicitar uma cópia dessas salvaguardas apropriadas entrando em contato com dataprivacy@avalara.com.
3. Períodos de retenção e eliminação dos seus Dados Pessoais
Nós e nossos prestadores de serviços armazenamos seus Dados Pessoais na medida necessária para o cumprimento de nossas obrigações e pelo tempo necessário para atingir as finalidades para as quais as informações são coletadas, em conformidade com as leis de proteção de dados aplicáveis. Quando não precisarmos mais armazenar ou usar seus Dados Pessoais para cumprir obrigações contratuais, legais ou regulamentares às quais estamos sujeitos (por exemplo, prazos legais de retenção ou se precisarmos deles para preservar provas dentro dos prazos legais de prescrição) ou para outros fins de acordo com a legislação aplicável (por exemplo, se você consentir que mantenhamos suas informações em arquivo para fins de contato sobre outras oportunidades de emprego), removeremos esses dados de nossos sistemas e registros ou tomaremos medidas para anonimizá-los adequadamente, de modo que você não possa mais ser identificado a partir deles.
4. Seus direitos
Os indivíduos têm diversos direitos em relação aos seus dados pessoais tratados conforme descrito neste Aviso. Esses direitos estão resumidos abaixo. Observe que o exercício desses direitos está sujeito a certos requisitos e condições estabelecidos nas leis aplicáveis.
Esses direitos também podem ser limitados em certas circunstâncias, por exemplo, se o atendimento de uma solicitação revelar dados pessoais sobre outra pessoa, infringir os direitos de terceiros (incluindo a Empresa) ou se um indivíduo nos solicitar a exclusão de dados que somos obrigados por lei ou que temos legítimo interesse em manter. As isenções relevantes estão previstas tanto na LGPD quanto em outras leis locais aplicáveis. Informaremos os indivíduos sobre quaisquer isenções relevantes nas quais nos baseamos ao responder a qualquer solicitação recebida.
Direito de confirmação e de acesso: Você tem o direito de obter da Empresa a confirmação de que seus Dados Pessoais estão sendo tratados e, em caso afirmativo, solicitar acesso a esses Dados Pessoais. As informações de acesso incluem – entre outras – as finalidades do tratamento, as categorias de Dados Pessoais em questão e os destinatários ou categorias de destinatários a quem os Dados Pessoais foram ou serão divulgados. Você tem o direito de obter uma cópia dos seus Dados Pessoais que estão sendo processados.
Direito à correção: Você tem o direito de obter da Empresa a correção de Dados Pessoais inexatos que lhe digam respeito. Dependendo das finalidades do tratamento, você poderá ter o direito de ter Dados Pessoais incompletos completados, inclusive por meio do fornecimento de uma declaração complementar.
Direito à anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com o disposto na LGPD.
Direito à portabilidade: Você tem o direito de receber seus Dados Pessoais que nos forneceu em um formato estruturado, de uso comum e legível por máquina, e tem o direito de transmitir esses Dados Pessoais a outra entidade sem impedimentos de nossa parte.
Direito de oposição: Você tem o direito de opor-se a tratamento realizado com fundamento em uma das hipóteses de dispensa de consentimento, em caso de descumprimento ao disposto na LGPD. Se você tiver o direito de se opor e exercer esse direito, seus Dados Pessoais não serão mais tratados por nós para tais fins. O exercício desse direito não acarretará nenhum custo. Tal direito de oposição pode não existir, em particular, se o tratamento de seus Dados Pessoais for necessário para a realização de diligências pré-contratuais ou para a execução de um contrato já celebrado.
Direito de revogação do consentimento (se aplicável): Para o tratamento de dados que se baseia no consentimento, você tem o direito de retirar seu consentimento a qualquer momento. No entanto, isso não afetará a legalidade de qualquer tratamento realizado antes da revogação do seu consentimento.
Direito de peticionar em relação aos seus dados contra o controlador perante a autoridade nacional: Sempre que você entender que seus direitos relativos aos seus dados pessoais foram violados, você tem o direito de apresentar uma reclamação perante a Agência Nacional de Proteção de Dados (ANPD).
Direito de revisão de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais: Se aplicável, você tem o direito de solicitar a revisão de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais, incluindo aquelas destinadas a definir o seu perfil pessoal, profissional, de consumo ou de crédito, ou aspectos da sua personalidade.
Direito de solicitar informações sobre o compartilhamento dos seus dados pessoais: Neste documento, descrevemos as categorias de terceiros com os quais podemos compartilhar seus Dados Pessoais. Caso deseje, você pode solicitar que divulguemos a identidade dos terceiros com os quais compartilhamos seus Dados Pessoais.
Caso deseje exercer esses direitos, ou se tiver dúvidas ou comentários sobre este Aviso, ou ainda para obter o endereço físico da empresa do Grupo Avalara para a qual está se candidatando, entre em contato com o responsável pela contratação na Avalara (ou com o encarregado de proteção de dados aplicável, quando houver) ou com o escritório global de privacidade de dados da Avalara. dataprivacy@avalara.com.
Se você fornecer dados pessoais de terceiros
Se você fornecer dados pessoais de terceiros à Empresa (por exemplo, dados de pessoas que solicitam ou fornecem referências pessoais ou dados de seus dependentes), deverá garantir que o fornecimento desses dados pessoais e o subsequente tratamento por parte da Empresa, nos termos deste Aviso, estejam em conformidade com as leis de proteção de dados aplicáveis. Por exemplo, você deve informar os terceiros sobre as finalidades e os meios de processamento de seus dados pessoais e obter o consentimento deles para o tratamento, conforme exigido pela legislação de proteção de dados aplicável. Quando aplicável, você também deverá autorizar terceiros a nos fornecerem suas informações pessoais solicitadas para as finalidades de tratamento indicadas acima (por exemplo, uma referência).
Atualizações e avisos
Se atualizarmos este Aviso, forneceremos a você um novo aviso. Também poderemos notificá-lo de outras maneiras, de tempos em tempos, sobre o tratamento de seus dados pessoais.
Última atualização: 30 de maio de 2023
Effective November 3rd 2025 to August 24th 2026
Download
Table of Contents
AVALARA
AVISO SOBRE O TRATAMENTO DE DADOS PESSOAIS PARA RECRUTAMENTO E INTEGRAÇÃO (ONBOARDING) - BRASIL
Este Aviso descreve as práticas da empresa do Grupo Avalara à qual você está se candidatando (“nós” ou “a Empresa”), na qualidade de controladora de dados, em relação ao tratamento (como coleta, uso, armazenamento, divulgação ou exclusão) de dados pessoais obtidos durante o processo de recrutamento e, caso você seja contratado(a), durante o processo de integração (“Dados Pessoais”). Este Aviso abrange todos os candidatos a emprego da Avalara Brasil - Assessoria e Consultoria Tributária e Tecnológica Ltda., suas empresas afiliadas e patrocinadores de private equity e empresas afiliadas (coletivamente, “Grupo Avalara”) no Brasil.
I. Categorias de Dados Pessoais
Tratamos Dados Pessoais não sensíveis (“Dados do Candidato”) e, na medida em que você os forneça, determinadas categorias especiais de Dados Pessoais (“Dados Pessoais Sensíveis do Candidato”), conforme exigido e permitido pela legislação aplicável.
Tratamos os seguintes Dados do Candidato:
Nome, endereço, e-mail, número de telefone (“Dados de Contato Básico”);
Passaporte, RG ou CPF, número de inscrição fiscal, nacionalidade, data e local de nascimento, gênero, informações de visto e permissão de trabalho, informações de viagem, dados de despesas, contatos de emergência, número da CNH, informações bancárias para configuração de folha de pagamento, contribuições para planos de saúde e previdência, estado civil, número de filhos e dados semelhantes (“Dados de Recursos Humanos”);
Informações contidas em seu currículo/CV, respostas a perguntas de triagem ou outros envios, histórico educacional, histórico profissional, qualificações, habilidades e experiências, verificações de referências, testes de habilidades, informações de idioma, informações fornecidas ou geradas por entrevistadores, recrutadores e referências (“Dados de Antecedentes/Background”);
Informações sobre seu acesso e uso das instalações e sistemas de computador do Grupo Avalara, como nome de usuário, endereço IP, e-mails e outras comunicações eletrônicas, documentos, arquivos, sites acessados e registros de log, informações de crachá de segurança, imagens e gravações de câmeras (“Dados de Segurança e Controle de Acesso”).
Além disso, tratamos os seguintes Dados Sensíveis do Candidato informados:
Informações sobre deficiência, para que possamos realizar ajustes razoáveis no processo de recrutamento ou no ambiente de trabalho.
Informações ou atestados de saúde (quando exigido por lei).
Filiação sindical (quando legalmente exigido).
Autodeclaração sobre origem racial ou étnica (quando legalmente exigido ou, mediante seu consentimento, para fins de programas de diversidade e inclusão).
II. Finalidades do Tratamento
Tratamos seus Dados Pessoais, conforme permitido ou exigido pela legislação aplicável, para as seguintes finalidades:
Administrar o processo seletivo e avaliar sua adequação à vaga para a qual se candidatou (ou outras vagas), incluindo a criação de dossiê do candidato, gestão da candidatura, realização de avaliações, entrevistas, organização ou reembolso de viagens e hospedagens, coleta de feedback, verificações de antecedentes e triagem; participação em iniciativas de diversidade; análises para compreender o perfil de candidatos; e integração, caso contratado (“Finalidades Relacionadas ao Recrutamento”);
cumprir leis e requisitos trabalhistas aplicáveis e administrar essas obrigações (“Finalidades Regulatórias”);
Facilitar e gerenciar a segurança e o controle de acesso às instalações, equipamentos e sistemas do Grupo Avalara, incluindo atividades de segurança (“Finalidades de Segurança e Controle de Acesso”); e
Apoiar qualquer reivindicação ou defesa que o Grupo Avalara possa enfrentar perante autoridades administrativas, judiciais, arbitrais ou de mediação, e cooperar com autoridades regulatórias ou policiais, conforme exigido por lei (“Finalidades Relacionadas a Litígios”).
III. Base Legal para o Tratamento de Dados Pessoais
A Lei Geral de Proteção de Dados Pessoais (“LGPD”) exige que qualquer tratamento de Dados Pessoais tenha uma base legal. Normalmente, utilizamos as seguintes bases:
Consentimento (art. 7º, I, e art. 11, I, da LGPD); Execução de contrato de trabalho ou procedimentos preliminares (art. 7º, V, e art. 11, II, d); Cumprimento de obrigação legal ou regulatória decorrente da relação de trabalho (art. 7º, II, e art. 11, II, a); Interesse legítimo, quando não prevalecerem seus direitos e liberdades fundamentais (art. 7º, IX).
Em geral, o tratamento dos seus Dados Pessoais é necessário para a análise do contrato de trabalho. De modo geral, é necessário fornecer seus Dados Pessoais para ser considerado(a) para uma vaga na Empresa, exceto em casos específicos em que indicamos que o fornecimento de determinados dados é facultativo.
Nos baseamos nas seguintes justificativas legais para o tratamento dos seus Dados Pessoais:
TRATAMENTO DE DADOS PESSOAIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados de candidatos envolvidas
Base legal
Finalidades relacionadas ao recrutamento
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Consentimento;
Execução de contrato;
Obrigação legal; ou
TRATAMENTO DE DADOS PESSOAIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados de candidatos envolvidas
Base legal
Interesse Legítimo para administrar adequadamente o processo de recrutamento (e, se aplicável, de integração)
Finalidades relacionadas à regulamentação
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Execução de contrato;
Obrigação legal; ou
Interesse Legítimo para administração da relação de trabalho.
Finalidades de segurança e controle de acesso
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Execução de contrato;
Obrigação legal; ou
Interesse Legítimo para facilitar e gerenciar a segurança e os controles de acesso relativos aos escritórios e instalações, equipamentos e sistemas do Grupo Avalara.
Finalidades relacionadas a litígios
Dados básicos de contato
Dados de recursos humanos
Dados de histórico (background)
Dados de segurança e controle de acesso
Exercício regular de direitos em processo judicial, administrativo ou arbitral;
Obrigação legal.
Realizamos testes de balanceamento para o tratamento de dados que efetuamos com base em nossos interesses legítimos; mais informações sobre esse processo podem ser obtidas junto ao responsável pela proteção de dados, utilizando os dados de contato publicados. Mais informações sobre o teste de balanceamento estão disponíveis mediante solicitação.
TRATAMENTO DE DADOS PESSOAIS SENSÍVEIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados sensíveis de candidatos envolvidas
Base legal
Finalidades relacionadas ao recrutamento, incluindo integração, iniciativas de monitoramento de igualdade de oportunidades e diversidade, adaptações para pessoas com deficiência e verificação do direito ao trabalho.
Informações sobre deficiência, quando fornecidas voluntariamente.
Outras informações de saúde, quando necessário coletá-las.
Dados sobre origem racial ou étnica, quando fornecidos
Consentimento (LGPD Art. 11(I) ou
Tratamento necessário para finalidade de
(i) cumprimento de obrigações legais ou regulatórias pelo controlador
TRATAMENTO DE DADOS PESSOAIS SENSÍVEIS DE CANDIDATOS
Finalidades do tratamento
Categorias de dados sensíveis de candidatos envolvidas
Base legal
voluntariamente ou contidos em seu passaporte ou outros documentos de cidadania e trabalhistas, ou informações coletadas para fins de visto e imigração.
(LGPD Art. 11(II)(a));
Proteção da vida ou da incolumidade física do titular ou de terceiro (ex. em caso de acidente de trabalho) (LGPD Art. 11(II)(e));
Avaliação da capacidade laboral de um trabalhador ou a prestação de cuidados ou tratamento de saúde (LGPD Art. 11(II)(a)).
Finalidades relacionadas à regulamentação
Informações sobre deficiência, quando fornecidas voluntariamente.
Outras informações de saúde, quando necessárias.
Dados sobre raça ou etnia, quando fornecidos voluntariamente ou contidos em seu passaporte ou outros documentos de cidadania e direito ao trabalho, ou informações coletadas para visto e imigração.
Finalidades relacionadas a litígios
Dados sensíveis do candidato relativos a reclamações ou defesas perante qualquer autoridade jurisdicional e/ou administrativa.
Tratamento necessário exercício regular de direitos, inclusive em contrato e em processo judicial, administrativo e arbitral (LGPD Art. 11(II)(d)).
IV. Transferências de dados, destinatários e justificativa legal para tais transferências
Compartilhamos suas informações internamente dentro da Empresa. Além disso, transferimos seus Dados Pessoais, em conformidade com a legislação aplicável, para as entidades do Grupo Avalara e terceiros (por exemplo, prestadores de serviços, autoridades governamentais e consultores externos). Alguns destinatários estão localizados fora do Brasil.
1. Destinatários externos dos seus dados pessoais
Outras empresas do Grupo Avalara: Em alguns casos, é necessário compartilhar os Dados do Candidato coletados localmente dentro do Grupo Avalara. Fazemos isso para facilitar a comunicação interna e a gestão de tarefas com outras empresas do grupo, o planejamento e a administração de RH em todo o grupo, em conexão com a estrutura matricial global do grupo, e para podermos cumprir a relação de trabalho dentro de nossa estrutura global. A base legal para essas transferências é a execução contratual e interesse legítimo, sendo nossos interesses legítimos os mencionados acima. O acesso aos Dados do Candidato é fornecido apenas quando necessário e sujeito a um conceito de acesso.
Em particular, os Dados Pessoais podem ser compartilhados com as seguintes empresas do Grupo Avalara:
Avalara, Inc. (US) e Avalara Europe Ltd. (UK) para os fins mencionados acima, visto que vários gestores seniores e funções de RH das entidades do Grupo Avalara no Espaço Econômico Europeu estão localizados nessas entidades; e
Avalara, Inc. (US), Avalara Europe Ltd. (UK) e outras entidades de serviços compartilhados para a prestação de serviços compartilhados, por exemplo, para hospedagem de dados e serviços de TI, processamento de aplicativos e suporte à integração, gestão de despesas de viagem, suporte e manutenção de TI.
A Avalara, Inc. ou Avalara Europe Ltd. atua como Operadora (conforme descrito abaixo) de alguns Dados Pessoais (por exemplo, hospeda o sistema global de informações de recursos humanos) e como Controladora em relação a outros Dados Pessoais.
Fornecedores de benefícios, seguradoras, consultores profissionais: Fornecedores de benefícios (como processadores de folha de pagamento ou provedores de planos de previdência), seguradoras (como administradoras de planos de saúde e seguradoras de vida) e corretoras, bem como outros prestadores de serviços de RH, também podem receber informações sobre seu salário, benefícios e participação acionária, conforme necessário para cotar, administrar e fornecer remuneração, benefícios e outras gratificações relacionadas ao trabalho, administrar a força de trabalho, cumprir as leis aplicáveis e os requisitos trabalhistas, comunicar-se com você e terceiros, e responder e atender a solicitações e demandas legais. Esses terceiros estão localizados no seu país de emprego e, dependendo da função, no Reino Unido, nos Estados Unidos e em outros países. Na medida em que esses fornecedores não atuem como Operadores (conforme abaixo), a base legal para tal transferência é a execução de contrato e o legítimo interesse.
Prestadores de serviços terceirizados: Determinados prestadores de serviços terceirizados, sejam eles afiliados ou não, receberão seus Dados Pessoais para processá-los sob instruções apropriadas (“Operadores”), conforme necessário para as finalidades do processamento, em particular para realizar verificações de antecedentes profissionais e determinadas atividades globais de gestão de RH ou tarefas relacionadas à TI (ou seja, para hospedagem ou manutenção de sistemas globais seguros ou da plataforma de recrutamento). Os Operadores estarão sujeitos a obrigações contratuais de implementar medidas de segurança técnicas e organizacionais adequadas para proteger seus Dados Pessoais e processá-los somente conforme instruídos. Uma lista dos operadores atualmente em atividade pode ser fornecida mediante solicitação a dataprivacy@avalara.com.
Empregadores anteriores: Podemos fornecer seus dados de candidato a empregadores anteriores para obter as referências e verificações de antecedentes necessárias.
Agências governamentais, órgãos reguladores e consultores profissionais: Poderemos precisar transferir seus Dados Pessoais para agências governamentais e reguladoras (por exemplo, autoridades fiscais, tribunais e autoridades governamentais) para cumprir obrigações legais, e para consultores profissionais externos, conforme necessário para cumprir obrigações legais, comunicar-nos com você e terceiros, responder e atender a solicitações e demandas legais e, de outra forma, atender a interesses legítimos (por exemplo, proteger os interesses legais do Grupo Avalara). Os consultores profissionais podem estar localizados no seu país de emprego ou, dependendo da função, no Reino Unido, nos Estados Unidos e em outros países. A base legal para essa transferência é o cumprimento de obrigação legal e o legítimo interesse.
Dados sensíveis dos candidatos só serão processados e transferidos se permitido pela legislação aplicável.
Potenciais Adquirentes ou Parceiros: Poderemos precisar compartilhar seus Dados Pessoais com empresas ou consultores profissionais de empresas que possam estar interessadas em adquirir a totalidade ou parte da participação ou dos ativos da Avalara, durante um processo de due diligence e negociação. Essas empresas e indivíduos podem estar localizados no Brasil ou no exterior.
Em relação às transferências de dados descritas acima, os Dados Pessoais podem, em alguns casos, ser transferidos para destinatários (i) em um país que possua uma decisão de adequação, (ii) vinculados por cláusulas contratuais padrão ou outro instrumento vinculativo que garanta o mesmo nível de proteção de dados que as cláusulas contratuais padrão, (iii) quando tal transferência for necessária para o estabelecimento, exercício ou defesa de direitos legais no contexto de processos administrativos, regulatórios ou judiciais específicos, (iv) quando for necessário para proteger a vida ou a segurança física do titular dos dados ou de outra pessoa física, (v) você tiver dado consentimento para tal transferência, ou (vi) o destinatário garantir, de outra forma, salvaguardas adequadas.
2. Transferências internacionais de dados
Transferimos Dados Pessoais para empresas do Grupo Avalara, prestadores de serviços, clientes, parceiros comerciais, reguladores e consultores localizados dentro ou fora do Brasil, como a Avalara, Inc. nos Estados Unidos, somente se necessário para os fins listados acima. Na medida em que seus Dados Pessoais sejam transferidos para países que não oferecem um nível adequado de proteção de dados sob a perspectiva da legislação brasileira, basearemos a respectiva transferência em salvaguardas apropriadas, como cláusulas contratuais padrão, quando exigido pela legislação aplicável. Você pode solicitar uma cópia dessas salvaguardas apropriadas entrando em contato com dataprivacy@avalara.com.
3. Períodos de retenção e eliminação dos seus Dados Pessoais
Nós e nossos prestadores de serviços armazenamos seus Dados Pessoais na medida necessária para o cumprimento de nossas obrigações e pelo tempo necessário para atingir as finalidades para as quais as informações são coletadas, em conformidade com as leis de proteção de dados aplicáveis. Quando não precisarmos mais armazenar ou usar seus Dados Pessoais para cumprir obrigações contratuais, legais ou regulamentares às quais estamos sujeitos (por exemplo, prazos legais de retenção ou se precisarmos deles para preservar provas dentro dos prazos legais de prescrição) ou para outros fins de acordo com a legislação aplicável (por exemplo, se você consentir que mantenhamos suas informações em arquivo para fins de contato sobre outras oportunidades de emprego), removeremos esses dados de nossos sistemas e registros ou tomaremos medidas para anonimizá-los adequadamente, de modo que você não possa mais ser identificado a partir deles.
4. Seus direitos
Os indivíduos têm diversos direitos em relação aos seus dados pessoais tratados conforme descrito neste Aviso. Esses direitos estão resumidos abaixo. Observe que o exercício desses direitos está sujeito a certos requisitos e condições estabelecidos nas leis aplicáveis.
Esses direitos também podem ser limitados em certas circunstâncias, por exemplo, se o atendimento de uma solicitação revelar dados pessoais sobre outra pessoa, infringir os direitos de terceiros (incluindo a Empresa) ou se um indivíduo nos solicitar a exclusão de dados que somos obrigados por lei ou que temos legítimo interesse em manter. As isenções relevantes estão previstas tanto na LGPD quanto em outras leis locais aplicáveis. Informaremos os indivíduos sobre quaisquer isenções relevantes nas quais nos baseamos ao responder a qualquer solicitação recebida.
Direito de confirmação e de acesso: Você tem o direito de obter da Empresa a confirmação de que seus Dados Pessoais estão sendo tratados e, em caso afirmativo, solicitar acesso a esses Dados Pessoais. As informações de acesso incluem – entre outras – as finalidades do tratamento, as categorias de Dados Pessoais em questão e os destinatários ou categorias de destinatários a quem os Dados Pessoais foram ou serão divulgados. Você tem o direito de obter uma cópia dos seus Dados Pessoais que estão sendo processados.
Direito à correção: Você tem o direito de obter da Empresa a correção de Dados Pessoais inexatos que lhe digam respeito. Dependendo das finalidades do tratamento, você poderá ter o direito de ter Dados Pessoais incompletos completados, inclusive por meio do fornecimento de uma declaração complementar.
Direito à anonimização, bloqueio ou eliminação de dados desnecessários, excessivos ou tratados em desconformidade com o disposto na LGPD.
Direito à portabilidade: Você tem o direito de receber seus Dados Pessoais que nos forneceu em um formato estruturado, de uso comum e legível por máquina, e tem o direito de transmitir esses Dados Pessoais a outra entidade sem impedimentos de nossa parte.
Direito de oposição: Você tem o direito de opor-se a tratamento realizado com fundamento em uma das hipóteses de dispensa de consentimento, em caso de descumprimento ao disposto na LGPD. Se você tiver o direito de se opor e exercer esse direito, seus Dados Pessoais não serão mais tratados por nós para tais fins. O exercício desse direito não acarretará nenhum custo. Tal direito de oposição pode não existir, em particular, se o tratamento de seus Dados Pessoais for necessário para a realização de diligências pré-contratuais ou para a execução de um contrato já celebrado.
Direito de revogação do consentimento (se aplicável): Para o tratamento de dados que se baseia no consentimento, você tem o direito de retirar seu consentimento a qualquer momento. No entanto, isso não afetará a legalidade de qualquer tratamento realizado antes da revogação do seu consentimento.
Direito de peticionar em relação aos seus dados contra o controlador perante a autoridade nacional: Sempre que você entender que seus direitos relativos aos seus dados pessoais foram violados, você tem o direito de apresentar uma reclamação perante a Agência Nacional de Proteção de Dados (ANPD).
Direito de revisão de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais: Se aplicável, você tem o direito de solicitar a revisão de decisões tomadas unicamente com base em tratamento automatizado de dados pessoais, incluindo aquelas destinadas a definir o seu perfil pessoal, profissional, de consumo ou de crédito, ou aspectos da sua personalidade.
Direito de solicitar informações sobre o compartilhamento dos seus dados pessoais: Neste documento, descrevemos as categorias de terceiros com os quais podemos compartilhar seus Dados Pessoais. Caso deseje, você pode solicitar que divulguemos a identidade dos terceiros com os quais compartilhamos seus Dados Pessoais.
Caso deseje exercer esses direitos, ou se tiver dúvidas ou comentários sobre este Aviso, ou ainda para obter o endereço físico da empresa do Grupo Avalara para a qual está se candidatando, entre em contato com o responsável pela contratação na Avalara (ou com o encarregado de proteção de dados aplicável, quando houver) ou com o escritório global de privacidade de dados da Avalara. dataprivacy@avalara.com.
Se você fornecer dados pessoais de terceiros
Se você fornecer dados pessoais de terceiros à Empresa (por exemplo, dados de pessoas que solicitam ou fornecem referências pessoais ou dados de seus dependentes), deverá garantir que o fornecimento desses dados pessoais e o subsequente tratamento por parte da Empresa, nos termos deste Aviso, estejam em conformidade com as leis de proteção de dados aplicáveis. Por exemplo, você deve informar os terceiros sobre as finalidades e os meios de processamento de seus dados pessoais e obter o consentimento deles para o tratamento, conforme exigido pela legislação de proteção de dados aplicável. Quando aplicável, você também deverá autorizar terceiros a nos fornecerem suas informações pessoais solicitadas para as finalidades de tratamento indicadas acima (por exemplo, uma referência).
Atualizações e avisos
Se atualizarmos este Aviso, forneceremos a você um novo aviso. Também poderemos notificá-lo de outras maneiras, de tempos em tempos, sobre o tratamento de seus dados pessoais.
Última atualização: 30 de maio de 2023
EEA & United Kingdom Privacy Notice IT Version
Version
Effective November 13th 2025
Download
Table of Contents
Avalara si impegna a proteggere la privacy delle persone di cui raccogliamo i dati personali ("l'utente" o "dell'utente"). Avalara potrebbe raccogliere dati personali da persone che si registrano per utilizzare i servizi, le applicazioni e i programmi di Avalara ("Servizi"), visitatori del nostro sito Web, persone che richiedono informazioni, potenziali clienti e partecipanti a eventi. La presente Informativa sulla privacy descrive come Avalara e le sue filiali e società affiliate ("Avalara" o "noi") raccolgono, utilizzano e divulgano i dati personali e le scelte che Avalara offre in merito alla raccolta e all'utilizzo dei dati personali.
Dati personali raccolti
Dati raccolti dall'utente:
Avalara raccoglie dati personali direttamente dall'utente, ad esempio quando quest'ultimo richiede informazioni su uno dei Servizi di Avalara o invia un'e-mail ad Avalara, o dalle interazioni con il nostro sito Web, prodotti o Servizi. I dettagli includono:
Categoria di dati personali
Finalità
Servizio abilitato tramite elaborazione dati
Dati di contatto.
Quando l'utente richiede informazioni sui nostri Servizi, si registra a un evento o a un seminario, scarica contenuti come i white paper, comunica con noi via e-mail, o accede a una chat in tempo reale, potremmo raccogliere i dati di contatto dell'utente, come il nome, la società, l'indirizzo, il numero di telefono, il numero di fax e l'indirizzo e-mail. Se l'azienda dell'utente utilizza i Servizi e forniamo all'utente un account, potremmo raccogliere il nome, indirizzo e-mail e indirizzo IP dell'utente associato come parte dell'utilizzo dei Servizi da parte della sua azienda.
Creazione dell'account, accesso, gestione dell'account, comunicazioni relative ai servizi.
Dati di fatturazione.
Quando l'utente acquista Servizi o si registra per partecipare a un evento, potremmo raccogliere informazioni sulla fatturazione e sul pagamento.
Facilitazione dell'acquisto di servizi
Dati sul dispositivo e sull'utilizzo.
Quando l'utente utilizza il nostro sito Web o i nostri Servizi, potremmo anche raccogliere automaticamente dati relativi al suo dispositivo e al suo utilizzo e all'attività sul nostro sito Web e sui nostri Servizi. Ad esempio, raccogliamo il tipo di sistema operativo del dispositivo, l'indirizzo IP, gli identificativi del dispositivo, il tipo di browser, il tipo di dispositivo, il nome di dominio, i tempi di accesso, la durata della visita e altre informazioni.
Prestazioni e funzionalità del servizio
Sicurezza e prevenzione delle frodi
Analisi e informazioni sull'utilizzo
Personalizzazione dell'esperienza utente
Conformità e reporting
Dati dalle nostre app mobili.
Quando l'utente utilizza i nostri Servizi mobili, potremmo raccogliere i suoi dati di contatto, la posizione geografica del dispositivo, le posizioni geografiche che fornisce ai nostri Servizi e le aree geografiche derivate dal suo indirizzo IP. Potremmo anche raccogliere informazioni sulle sue fatture come indirizzi postali, numeri di fattura, numeri di certificati di esenzione, descrizioni degli articoli, quantità e importi.
Facilitazione della comunicazione relativa all'account
Fornire servizi basati sulla posizione
Facilitare il processo di fatturazione
Dati della chat.
Quando si avvia una chat in tempo reale, Avalara raccoglierà un registro sull'interazione dell'utente con gli agenti della chat di Avalara.
Assistenza clienti e risoluzione dei problemi
Garanzia della qualità del servizio e formazione degli agenti
Audit e conformità legale
Cookie e altre tecnologie.
Quando l'utente naviga sul nostro sito Web, potremmo utilizzare cookie o altre tecnologie per raccogliere dati sul suo dispositivo e sull'attività sul nostro sito Web. Per ulteriori informazioni sui cookie e sulle altre tecnologie che utilizziamo, sui dati che raccogliamo e sulle scelte dell'utente, fare clic qui.
Mantenimento delle sessioni utente durante l'accesso
Prestazioni del server
Salvataggio delle personalizzazioni dell'interfaccia utente
Gestione del consenso
Dati personali raccolti da altre fonti:
Avalara potrebbe anche raccogliere dati personali da altre fonti, comprese terze parti da cui abbiamo acquistato dati, e potrebbe combinare questi dati con quelli che già possiede sull'utente. Ad esempio, potremmo raccogliere dati personali da:
Partner.Avalara può impegnarsi in attività di marketing congiunte o sponsorizzazioni di eventi con i nostri partner di terze parti e potremmo raccogliere dati personali sull'utente da queste attività. Consentiamo inoltre ai partner di fornire ad Avalara segnalazioni di persone che potrebbero essere interessate a saperne di più sui Servizi di Avalara. Contiamo sui nostri partner per ottenere il consenso dell'utente prima di condividere i suoi dati personali con noi.
Fornitori di servizi.Avalara può anche collaborare con fornitori di servizi terzi che ci aiutano a capire in che modo i nostri clienti utilizzano i Servizi di Avalara.
Come utilizziamo i dati personali dell'utente
Avalara utilizza i dati dell'utente come segue:
Comunicando con l'utente.Il sito Web di Avalara consente di scaricare white paper, compilare moduli per ulteriori dettagli sui nostri Servizi e di interagire con noi tramite la nostra funzionalità di chat. È inoltre possibile registrarsi per partecipare a seminari online o eventi di persona. Utilizziamo queste informazioni per fornire all'utente il materiale richiesto, per ricontattare l'utente in base al suo interesse nei Servizi o per registrare l'utente all'evento richiesto. Potremmo anche utilizzare i dati personali per comprendere l'utente e le sue preferenze in modo da migliorare la sua esperienza e inviargli informazioni su Avalara, i nostri affiliati e i nostri partner, come informazioni su promozioni o eventi.
Avalara può anche ricevere dati personali da altre fonti, comprese terze parti da cui abbiamo acquistato dati, e combinarli con i dati che già abbiamo sull'utente. Questo ci aiuta ad aggiornare, espandere e analizzare i nostri registri, identificare nuovi clienti e creare pubblicità più personalizzate per fornire prodotti e servizi che potrebbero essere interessanti per l'utente.
Se l'utente segue o mette mi piace ad Avalara su siti di social media di terze parti, possiamo vedere il suo profilo pubblico e potremmo indirizzargli pubblicità.
Pubblicità. Potremmo utilizzare i dati raccolti tramite cookie e altre tecnologie per gestire la nostra pubblicità su altri siti o per fornire all'utente offerte o pubblicità, anche per servizi di terze parti, in base alle attività e agli interessi di navigazione dell'utente. Per ulteriori informazioni, fare clic qui.
Basi giuridiche per il trattamento (utenti SEE e Regno Unito).Raccogliamo ed elaboriamo informazioni sugli utenti con sede nello Spazio Economico Europeo ("SEE") e nel Regno Unito laddove consentito ai sensi della legge applicabile. Avalara si basa su una delle seguenti quattro basi giuridiche per il trattamento dei dati:
Contratto. Quando l'utente o la sua azienda concludono un accordo con noi, elaboreremo i suoi dati per adempiere ai termini del nostro contratto.
Interesse legittimo. Abbiamo un interesse legittimo a proteggere la sicurezza dei nostri Servizi, a gestire e migliorare i Servizi, a sostenere i nostri clienti, a commercializzare e promuovere i Servizi e a proteggere i nostri interessi.
Consenso. In alcuni casi, l'utente fornirà il consenso all'utilizzo dei suoi dati per finalità specifiche.
Obbligo legale. Potremmo essere tenuti a trattare i dati dell'utente per ottemperare a un obbligo legale.
Gli utenti dello SEE e del Regno Unito godono di una serie di diritti in relazione ai loro dati personali trattati da Avalara. Le persone residenti nello SEE o nel Regno Unito possono rivedere un riepilogo di tali diritti in questa Informativa sulla privacy.
Come vengono conservati i dati personali dell'utente
Conservazione ed eliminazione dei dati. Avalara e i nostri fornitori di servizi archiviano i dati personali degli utenti dello SEE e del Regno Unito per il tempo necessario a raggiungere gli scopi per i quali le informazioni vengono raccolte, in conformità con le leggi sulla protezione dei dati applicabili. Quando non sarà più necessario conservare o utilizzare i dati personali per adempiere agli obblighi contrattuali, legali o normativi a cui siamo soggetti (ad esempio, periodi di conservazione previsti dalla legge o se ne abbiamo bisogno per conservare le prove entro i termini di prescrizione previsti dalla legge) o per altri scopi in conformità con la legge applicabile, li rimuoveremo dai nostri sistemi e registri o adotteremo misure per renderli adeguatamente anonimi in modo che l'utente non possa più essere identificato da essi.
Perché condividiamo i dati personali
Fornitori di servizi.Avalara può condividere i dati dell'utente con i nostri fornitori di servizi e partner contrattuali in modo che questi possano eseguire servizi per nostro conto. Ad esempio, utilizziamo una piattaforma di gestione delle relazioni con i clienti di terze parti o una piattaforma di analisi dei dati per organizzare i dati e comprendere meglio i nostri clienti e potenziali clienti. Tali fornitori di servizi sono autorizzati a utilizzare i dati dell'utente solo se necessario per fornirci i servizi richiesti. Potremmo anche condividere dati personali con siti di social network di terze parti, come LinkedIn, per scopi di marketing e pubblicità su tali siti. Salvo quanto descritto in questa Informativa sulla Privacy, Avalara non condivide, vende, affitta o scambia alcun dato con terze parti per scopi promozionali.
Società affiliate e filiali. Potremmo condividere i dati dell'utente con le nostre filiali e società affiliate (ossia le entità sotto controllo comune) per fornire i Servizi richiesti dall'utente, come assistenza clienti, marketing, operazioni tecniche e scopi di gestione degli account.
Partner di Avalara.L'ampia rete di partner di Avalara offre una vasta gamma di integrazioni che consentono ai nostri Servizi di interconnettersi con software di terze parti. Potremmo condividere i dati dell'utente con questi partner per supportare i nostri clienti reciproci. Potremmo anche condividere i dati dell'utente con i nostri partner che co-sponsorizzano eventi a cui l'utente sceglie di partecipare.
Fatturazione.Avalara utilizza un fornitore di servizi di terze parti per gestire l'elaborazione delle carte di credito. Tale fornitore di servizi non è autorizzato a memorizzare, trattenere o utilizzare informazioni di fatturazione se non per il solo scopo di elaborazione delle carte di credito per nostro conto.
Divulgazione obbligatoria.Avalara si riserva il diritto di condividere i dati dell'utente se richiesto dalla legge o per conformarsi a un procedimento giudiziario, a un'ordinanza del tribunale o a un processo legale valido. Potremmo anche divulgare i dati dell'utente per proteggere i diritti e la proprietà di Avalara, dei nostri agenti, dipendenti, partner e clienti, anche per prevenire o fermare un attacco ai nostri sistemi o alla nostra rete o per prevenire spam o tentativi di frode ai danni dei nostri utenti. Infine, potremmo anche aver bisogno di divulgare i dati dell'utente in relazione o durante la negoziazione di qualsiasi fusione, finanziamento, acquisizione, fallimento, scioglimento, transazione o procedimento che coinvolge la vendita, il trasferimento, la cessione o la divulgazione di tutta o parte della nostra attività o dei nostri beni a un'altra società.
I diritti dell'utente in qualità di interessato
Le persone residenti nello Spazio Economico Europeo ("SEE") e nel Regno Unito godono di una serie di diritti in relazione ai propri dati personali trattati da Avalara. Questi sono riassunti di seguito. Si noti che l'esercizio di questi diritti è soggetto a determinati requisiti e condizioni stabiliti dalle leggi applicabili. Questi diritti possono anche essere limitati in determinate circostanze, ad esempio se soddisfare una richiesta comporta la divulgazione di informazioni personali su un'altra persona, in violazione dei diritti di altri (inclusa Avalara), o se una persona richiede di cancellare le informazioni che siamo tenuti a conservare per legge o per interessi legittimi cogenti. Le esenzioni pertinenti sono incluse, se applicabili, nel Regolamento (UE) 2016/679 (il Regolamento generale sulla protezione dei dati, o "GDPR"), nella versione conservata del GDPR del Regno Unito come implementata dal Data Protection Act 2018 e nelle leggi locali applicabili. Informeremo le persone di eventuali esenzioni pertinenti su cui facciamo affidamento nella risposta a qualsiasi richiesta ricevuta.
Diritto di accesso. L'utente ha il diritto di ottenere da Avalara conferma del trattamento dei suoi dati personali e, se del caso, di richiedervi l'accesso. Le informazioni di accesso comprendono, tra l'altro, le finalità del trattamento, le categorie di dati personali interessate e i destinatari o le categorie di destinatari a cui i dati personali sono stati o saranno comunicati. L'utente ha il diritto di ottenere una copia dei dati personali oggetto del trattamento. Ai sensi della legge applicabile, potremmo addebitare una tariffa ragionevole per le copie, in base ai costi amministrativi.
Diritto di rettifica. L'utente ha il diritto di ottenere da Avalara la rettifica di dati personali inesatti che lo riguardano. A seconda delle finalità del trattamento, l'utente può avere il diritto di completare i dati personali incompleti, anche fornendo una dichiarazione supplementare.
Diritto alla cancellazione (all'oblio). L'utente ha il diritto di chiedere ad Avalara di cancellarei propri dati personali.
Diritto di limitazione del trattamento. L'utente ha il diritto di richiedere la limitazione del trattamento dei propri dati personali, nel qual caso, saranno contrassegnati e trattati da Avalara solo per determinate finalità.
Diritto alla portabilità dei dati. L'utente ha il diritto di ricevere i dati personali che ha fornito ad Avalara in un formato strutturato, di uso comune e leggibile da una macchina e ha il diritto di trasmettere i dati personali a un'altra entità senza impedimenti da parte nostra.
Diritto di opposizione. L'utente può avere il diritto di opporsi, per motivi legati alla sua situazione particolare e in qualsiasi momento, al trattamento dei suoi dati personali da parte di Avalara, la quale potrebbe essere tenuta a non trattare più i dati personali dell'utente. Se l'utente ha il diritto di opporsi ed esercita tale diritto, i suoi dati personali non saranno più trattati per tali finalità da Avalara. L'esercizio di tale diritto non comporterà alcun costo. Tale diritto di opposizione può non sussistere, in particolare, se il trattamento dei dati personali dell'utente è necessario per adottare misure prima di stipulare un contratto o per eseguire un contratto già concluso.
Per esercitare tali diritti, o per domande o reclami in merito a questa comunicazione, inviare un'e-mail a dataprivacy@avalara.com.
L'utente ha inoltre il diritto di presentare un reclamo all'autorità di controllo competente per le questioni relative alla protezione dei dati.
In che modo l'utente può gestire i suoi dati personali
Preferenze di comunicazione. Se sono state ricevute comunicazioni promozionali da Avalara via e-mail e si desidera rinunciare a comunicazioni future, fare clic sul link "Annulla iscrizione" che si trova in fondo al messaggio di posta elettronica o accedere qui. Se si annulla l'iscrizione alla ricezione di comunicazioni promozionali, è comunque possibile ricevere messaggi transazionali riguardanti le notifiche del Servizio, gli aggiornamenti dei nostri termini o dell'Informativa sulla privacy o la nostra relazione in corso. Per disattivare altre forme di comunicazione, è possibile annullare l'iscrizione contattandoci utilizzando le informazioni nella sezione "Come contattarci" di seguito.
Gestione dei dati personali.Avalara fornisce diversi account con funzionalità diverse a seconda dell'accesso degli utenti dei Servizi. Gli account Avalara generalmente consentono di aggiornare le impostazioni utente o il profilo accedendo al sito Web o al Servizio con il proprio nome utente e password. Se non si dispone di un account ma si desidera effettuare una richiesta per gestire i propri dati, è possibile contattare Avalara utilizzando le informazioni nella sezione "Come contattarci" di seguito.
Le richieste di gestione dei dati da parte dell'utente verranno evase entro un lasso di tempo ragionevole. I dipendenti di un cliente Avalara possono anche contattare l'amministratore di sistema della propria azienda per assistenza nella gestione dei dati.
California Privacy Rights
I residenti in California possono consultare le divulgazioni del California Consumer Privacy Act di Avalara qui.
Trasferimenti internazionali di dati personali
Avalara può elaborare e archiviare i dati dell'utente nella sua area geografica o può trasferirli negli Stati Uniti o in altri Paesi in cui abbiamo affiliate, filiali o fornitori di servizi. Qui è disponibile un elenco dei nostri uffici globali. Possiamo trasferire dati dallo Spazio economico europeo e dalla Svizzera ad altri Paesi e, quando lo facciamo, utilizziamo meccanismi legali come i contratti per assicurarci che vi sia un meccanismo di trasferimento adeguato in atto.
Titolare del trattamento
Se l'utente risiede nello SEE o nel Regno Unito, Avalara Europe Ltd, con sede a Lanchester House, First Floor, Trafalgar Place, Brighton, Regno Unito, BN1 4FU, è il titolare del trattamento dei dati personali dell'utente.
Per tutte le altre persone, Avalara, Inc., con sede in 512 S Mangum St #100, Durham, NC 27701, USA, è il titolare del trattamento dei dati personali dell'utente. Il nostro numero di telefono è 1-877-814-9390.
Monitoraggio delle e-mail in arrivo
Tutte le e-mail in arrivo inviate agli account e-mail di Avalara saranno archiviate e potrebbero essere scansionate da Avalara e/o dai nostri fornitori di servizi esterni per rilevare e prevenire minacce ai nostri sistemi, indagare su comportamenti illegali o inappropriati e/o eliminare e-mail promozionali non richieste ("spam"). In caso di dubbi su questo processo, è possibile richiedere ulteriori informazioni.
Modifiche alla presente Informativa sulla privacy
Avalara si riserva il diritto di modificare la presente Informativa sulla privacy. In caso di modifiche all'Informativa sulla privacy, aggiorneremo questa pagina e modificheremo la data dell'"ultimo aggiornamento" sopra riportata.
Come contattarci
In caso di domande o reclami sulla presente Informativa sulla privacy, inviare un'e-mail all'indirizzo dataprivacy@avalara.com.
EEA & United Kingdom Privacy Notice ES Version
Version
Effective November 13th 2025
Download
Table of Contents
Avalara se compromete a proteger la privacidad de las personas cuyos datos personales recopilamos («usted» o «su»). Avalara puede recopilar datos personales de personas que se registren para utilizar los servicios, las aplicaciones y los programas de Avalara («Servicios»), de visitantes de nuestro sitio web, de personas que soliciten información, de clientes en prospecto y de asistentes a eventos. En este Aviso de privacidad se describe cómo Avalara y sus empresas afiliadas y subsidiarias («Avalara» o «nosotros») recopilan, utilizan y divulgan datos personales, así como las opciones que Avalara ofrece respecto a la recopilación y el uso de datos personales.
Datos personales recopilados
Datos recopilados de usted:
Avalara recopila datos personales directamente de usted (por ejemplo, cuando realiza una consulta sobre uno de los Servicios de Avalara o envía un correo electrónico a Avalara) o de sus interacciones con nuestro sitio web, productos o Servicios. Se incluye la siguiente información:
Categoría de datos personales
Propósito
Servicio habilitado mediante el tratamiento de datos
Información de contacto.
Cuando realiza una consulta sobre nuestros Servicios, se registra para un evento o seminario, descarga contenido como documentos técnicos, se comunica con nosotros por correo electrónico o entra en un chat en directo, podemos recopilar su información de contacto; por ejemplo, su nombre, empresa, dirección, número de teléfono, número de fax y dirección de correo electrónico. Si su empresa utiliza los Servicios y le proporcionamos una cuenta, podemos recopilar su nombre, dirección de correo electrónico y dirección IP asociada como parte del uso de los Servicios que hace su empresa.
Creación de cuenta, inicio de sesión, gestión de cuentas y comunicaciones relacionadas con el servicio.
Datos de facturación.
Cuando compra Servicios o se registra para asistir a un evento, podemos recopilar información de facturación y pago.
Facilitación de la compra de servicios
Datos de uso y del dispositivo.
Cuando utiliza nuestro sitio web o nuestros Servicios, también podemos recopilar automáticamente datos sobre su dispositivo, así como sobre su uso y actividad en nuestro sitio web y Servicios. Por ejemplo, recopilamos el tipo de sistema operativo de su dispositivo, la dirección IP, los identificadores del dispositivo, el tipo de navegador, el tipo de dispositivo, el nombre de dominio, las horas de acceso y la duración de la visita, entre otra información.
Funcionalidad y rendimiento del servicio
Seguridad y prevención del fraude
Información de uso y análisis
Personalización de la experiencia del cliente
Cumplimiento e informes
Datos de nuestras aplicaciones móviles.
Cuando utiliza nuestros Servicios móviles, podemos recopilar su información de contacto, la ubicación geográfica del dispositivo, las ubicaciones geográficas que proporcione a nuestros Servicios y las áreas geográficas derivadas de su dirección IP. También podemos recopilar información sobre sus facturas; por ejemplo, direcciones postales, números de factura, números de certificados de exención, descripciones de artículos, cantidades e importes.
Optimización de las comunicaciones relacionadas con la cuenta
Prestación de servicios basados en la ubicación
Optimización del proceso de facturación
Datos del chat.
Cuando inicia un chat en directo, Avalara registrará la interacción entre usted y sus agentes de chat.
Atención al cliente y resolución de problemas
Garantía de la calidad del servicio y formación de agentes
Auditoría y cumplimiento legal
Cookies y otras tecnologías.
Cuando navega por nuestro sitio web, podemos utilizar cookies u otras tecnologías para recopilar datos sobre su dispositivo y actividad en nuestro sitio web. Para obtener más información sobre las cookies y otras tecnologías que utilizamos, así como sobre los datos que recopilamos y sus elecciones, haga clic aquí.
Mantenimiento de las sesiones de los usuarios durante el inicio de sesión
Rendimiento del servidor
Almacenamiento de personalizaciones de la interfaz de usuario
Gestión del consentimiento
Datos personales recopilados de otras fuentes:
Avalara también puede recopilar datos personales de otras fuentes, incluidos terceros a quienes hayamos comprado datos, y podemos combinarlos con los datos que ya tengamos sobre usted. Por ejemplo, podemos recopilar datos personales a partir de:
Socios: Avalara puede participar en actividades de marketing conjuntas o patrocinios de eventos con nuestros socios externos, y podemos recopilar datos personales sobre usted a partir de estas actividades. También permitimos que los socios proporcionen a Avalara datos de personas que puedan estar interesadas en saber más sobre los Servicios de Avalara. Confiamos en que nuestros socios obtienen su permiso antes de compartir sus datos personales con nosotros.
Proveedores de servicios: Avalara también puede colaborar con proveedores de servicios de terceros que nos ayuden a entender cómo nuestros clientes utilizan los Servicios de Avalara.
Cómo utilizamos sus datos personales
Avalara utiliza sus datos para los siguientes fines:
Comunicarse con usted: en el sitio web de Avalara puede descargar documentos técnicos, completar formularios para obtener más información sobre nuestros Servicios y ponerse en contacto con nosotros a través del chat. También puede registrarse para asistir a seminarios en línea o eventos presenciales. Utilizamos esta información para proporcionarle el material que ha solicitado, hacer un seguimiento de su interés en los Servicios o registrarle en el evento que solicita. Además, podemos utilizar datos personales para entender sus preferencias y a usted, de modo que podamos mejorar su experiencia y enviarle información sobre Avalara, nuestros afiliados y nuestros socios, como información sobre promociones o eventos.
Avalara también puede recibir datos personales de otras fuentes, incluidos terceros a quienes hayamos comprado datos, y combinarlos con los datos que ya tengamos sobre usted. Esto nos ayuda a actualizar, ampliar y analizar nuestros registros, identificar nuevos clientes y crear publicidad más personalizada para ofrecer productos y servicios que puedan ser de su interés.
Si sigue a Avalara o indica que le gusta nuestra empresa en sitios de redes sociales de terceros, podemos ver su perfil público y dirigir publicidad hacia usted.
Publicidad: podemos utilizar los datos recopilados a través de cookies y otras tecnologías para gestionar nuestra publicidad en otros sitios o para mostrarle ofertas o anuncios (incluidos los de servicios de terceros) en función de sus actividades de navegación e intereses. Para obtener más información, haga clic aquí.
Bases legales para el tratamiento (usuarios del EEE y Reino Unido): recopilamos y tratamos información sobre usuarios del Espacio Económico Europeo («EEE») y Reino Unido («R. U.») siempre que tengamos un fundamento jurídico para hacerlo según la legislación aplicable. Avalara se basa en uno de los cuatro fundamentos jurídicos siguientes para tratar sus datos:
Contrato: cuando usted o su empresa celebren un acuerdo con nosotros, trataremos sus datos para cumplir con las condiciones de nuestro contrato.
Interés legítimo: tenemos un interés legítimo en mantener la seguridad y la protección de nuestros Servicios, hacerlos funcionar y mejorarlos, apoyar a nuestros clientes, comercializar y promocionar los Servicios y proteger nuestros intereses.
Consentimiento: en algunos casos, nos proporcionará su consentimiento para usar sus datos con un fin específico.
Obligación legal: es posible que debamos tratar sus datos para cumplir con una obligación legal.
Los usuarios del EEE y Reino Unido tienen una serie de derechos en relación con el tratamiento de sus datos personales por parte de Avalara. Las personas que residan en el EEE o Reino Unido pueden consultar un resumen de estos derechos en el presente Aviso de privacidad.
Cómo conservamos sus datos personales
Conservación y eliminación de datos: Avalara y nuestros proveedores de servicios almacenan los datos personales de los usuarios del EEE y Reino Unido durante el tiempo necesario para lograr los fines para los que se recopila la información, de acuerdo con las leyes de protección de datos aplicables. Cuando ya no necesitemos almacenar o utilizar sus datos personales para cumplir con las obligaciones contractuales, legales o regulatorias a las que estamos sujetos (por ejemplo, plazos de conservación obligatorios o si los necesitamos para preservar pruebas dentro de los estatutos legales de limitación), o para otros fines de acuerdo con la legislación aplicable, los eliminaremos de nuestros sistemas y registros o tomaremos medidas para anonimizarlos adecuadamente de modo que ya no se le pueda identificar a partir de ellos.
Por qué compartimos datos personales
Proveedores de servicios: Avalara puede compartir sus datos con nuestros proveedores de servicios y comerciantes contratados para que puedan llevar a cabo servicios en nuestro nombre. Por ejemplo, utilizamos una plataforma de gestión de relaciones con clientes de terceros o una plataforma de análisis de datos para organizar datos y comprender mejor a nuestros clientes y clientes en prospecto. Estos proveedores de servicios están autorizados para utilizar sus datos solo en la medida necesaria para proporcionar los servicios solicitados. Asimismo, podemos compartir datos personales con sitios web externos de establecimiento de contactos, como LinkedIn, para nuestra publicidad y marketing en esos sitios web. A menos que se describa lo contrario en este Aviso de privacidad, Avalara no comparte, vende, alquila ni intercambia ningún dato con terceros para sus fines promocionales.
Afiliados y subsidiarios: podemos compartir sus datos con nuestros afiliados y subsidiarios (entidades bajo control común) para proporcionar los Servicios que solicite, como atención al cliente, marketing, operaciones técnicas y gestión de cuentas.
Socios de Avalara: la extensa red de socios de Avalara proporciona una amplia variedad de integraciones que permiten que nuestros Servicios se interconecten con software de terceros. Podemos compartir sus datos con estos socios para asistir a nuestros clientes en común, así como con los socios que copatrocinen eventos a los que decida asistir.
Facturación: Avalara utiliza un proveedor de servicios de terceros para gestionar el tratamiento de tarjetas de crédito. Este proveedor de servicios no tiene permitido almacenar, conservar ni utilizar información de facturación, excepto para el único propósito de procesar tarjetas de crédito en nuestro nombre.
Divulgación obligatoria: Avalara se reserva el derecho de compartir sus datos si así lo requiere la ley o para cumplir con un procedimiento u orden judiciales o un proceso legal válido. También podemos divulgar sus datos para proteger los derechos y la propiedad de Avalara, nuestros agentes, empleados, socios y clientes, así como para prevenir o detener un ataque a nuestros sistemas o red, o para prevenir el spam o intentos de estafar a nuestros usuarios. Por último, es posible que también necesitemos divulgar sus datos en relación con la negociación de cualquier fusión, financiación, adquisición, insolvencia, disolución, transacción o procedimiento (o durante esta) que implique la venta, transferencia, desinversión o divulgación de la totalidad o de una parte de nuestros activos o empresa a otra compañía.
Sus derechos como interesado
Las personas que residen en el Espacio Económico Europeo («EEE») y Reino Unido tienen una serie de derechos en relación con sus datos personales tratados por Avalara. Estos se resumen a continuación. Tenga en cuenta que el ejercicio de estos derechos está sujeto a ciertos requisitos y condiciones establecidos en las leyes aplicables. Estos derechos también pueden verse limitados en ciertas circunstancias; por ejemplo, si cumplir con una solicitud revelaría información personal sobre otra persona, lo que infringiría los derechos de un tercero (incluida Avalara), o si una persona nos pide que eliminemos información que estamos obligados a conservar por ley o sobre la que tenemos intereses legítimos para su conservación. Se incluyen exenciones pertinentes, según corresponda, en el Reglamento (UE) 2016/679 (el Reglamento General de Protección de Datos o «RGPD»), la versión conservada del RGPD del Reino Unido, tal como se implementa por la Ley de Protección de Datos de 2018, y las leyes locales aplicables. Informaremos a las personas de cualquier exención pertinente en la que nos basemos al responder a cualquier solicitud recibida.
Derecho de acceso: tiene derecho a obtener la confirmación de Avalara sobre si sus datos personales se están tratando, y, en caso afirmativo, solicitar acceso a ellos. La información de acceso incluye, entre otros, los fines del tratamiento, las categorías de datos personales afectadas y los destinatarios o categorías de destinatarios a quienes se han divulgado o se divulgarán los datos personales. Tiene derecho a obtener una copia de los datos personales que se están tratando. De acuerdo con la legislación aplicable, podemos cobrar una tarifa razonable por copias, en función de los costes administrativos.
Derecho de rectificación: tiene derecho a exigir que Avalara rectifique los datos personales inexactos que le conciernan. Según los fines del tratamiento, puede tener derecho a completar datos personales incompletos, incluso mediante la presentación de una declaración complementaria.
Derecho a la supresión (al olvido): tiene derecho a pedir a Avalara que borre sus datos personales.
Derecho a la restricción del tratamiento: tiene derecho a solicitar la restricción del tratamiento de sus datos personales, en cuyo caso, Avalara los marcaría y trataría únicamente para unos fines determinados.
Derecho a la portabilidad de datos: tiene derecho a recibir los datos personales que ha proporcionado a Avalara en un formato estructurado, de uso común y legible por máquina, así como a transmitir los datos personales a otra entidad sin ningún impedimento por nuestra parte.
Derecho a la oposición: puede que tenga derecho a oponerse, por motivos relacionados con su situación particular, al tratamiento de sus datos personales por parte de Avalara en cualquier momento, y podríamos estar obligados a dejar de tratar sus datos personales. Si tiene este derecho y lo ejerce, Avalara dejará de tratar sus datos personales para tales fines. Ejercer este derecho no incurrirá en ningún coste. Es posible que no disponga del derecho a la oposición, en particular, si el tratamiento de sus datos personales es necesario para adoptar medidas previas a la celebración de un contrato o para ejecutar un contrato ya concluido.
Si desea ejercer estos derechos o tiene preguntas o quejas sobre este aviso, envíenos un correo electrónico a dataprivacy@avalara.com.
También tiene derecho a presentar una demanda ante la autoridad de supervisión competente en relación con cuestiones de protección de datos.
Cómo gestionar sus datos personales
Preferencias de comunicación: si ha recibido comunicaciones promocionales de Avalara por correo electrónico y le gustaría darse de baja de futuras comunicaciones, puede hacer clic en el enlace «Cancelar suscripción» situado en la parte inferior del mensaje de correo electrónico o acceder aquí. Si cancela la suscripción para recibir comunicaciones promocionales, puede que aún reciba mensajes transaccionales relacionados con notificaciones del Servicio, actualizaciones de nuestras condiciones o Aviso de privacidad, o nuestra relación continua. Para dejar de recibir otras formas de comunicación, puede cancelar la suscripción poniéndose en contacto con nosotros usando la información en la sección «Contacto» a continuación.
Gestión de datos personales. Avalara proporciona diferentes cuentas con diversas funciones según los Servicios a los que accedan los usuarios. Por lo general, las cuentas de Avalara le permiten actualizar la configuración de usuario o perfil iniciando sesión en el sitio web o Servicio correspondiente con su nombre de usuario y contraseña. Si no tiene una cuenta, pero desea realizar una solicitud para gestionar sus datos, puede ponerse en contacto con Avalara usando la información en la sección «Contacto» a continuación.
Las solicitudes para gestionar sus datos se atenderán dentro de un plazo razonable. Si forma parte del personal de un cliente de Avalara, puede que también desee ponerse en contacto con el administrador del sistema de su empresa para obtener ayuda con la gestión de sus datos.
Derechos de privacidad de California
Los residentes de California pueden revisar las disposiciones de la Ley de Privacidad del Consumidor de California de Avalara aquí.
Transferencias internacionales de datos personales
Avalara puede tratar y almacenar sus datos en su región o podemos transferirlos a Estados Unidos o a otros países en los que tengamos afiliados, subsidiarios o proveedores de servicios. Puede consultar una lista de nuestras oficinas globales aquí. Podemos transferir datos desde el Espacio Económico Europeo y Suiza a otros países y, cuando lo hacemos, utilizamos mecanismos legales como contratos para garantizar que se emplea un mecanismo de transferencia adecuado.
Responsable del tratamiento de los datos
Si reside en el EEE o Reino Unido, Avalara Europe Ltd, ubicada en Lanchester House, primera planta, Trafalgar Place, Brighton, Reino Unido, BN1 4FU, es responsable de sus datos personales.
Para todas las demás personas, Avalara, Inc., ubicada en 512 S Mangum St #100, Durham, NC 27701, EE. UU., es responsable de sus datos personales. Nuestro número de teléfono es +1 877 814 9390.
Supervisión de los correos electrónicos entrantes
Avalara (o nuestro proveedor de servicios de terceros) archivará todos los correos electrónicos entrantes enviados a las cuentas de correo electrónico de Avalara y puede escanearlos para detectar y prevenir amenazas a nuestros sistemas, investigar comportamientos ilegales o inapropiados y eliminar correos electrónicos promocionales no solicitados («spam»). Si tiene alguna duda sobre este proceso, póngase en contacto con nosotros.
Cambios en este Aviso de privacidad
Avalara se reserva el derecho a cambiar este Aviso de privacidad. Cuando realicemos cambios en el Aviso de privacidad, actualizaremos esta página y cambiaremos la fecha de «Última actualización» arriba.
Contacto
Si tiene alguna pregunta o queja sobre este Aviso de privacidad, envíenos un correo electrónico a dataprivacy@avalara.com.
EEA & United Kingdom Privacy Notice DE Version
Version
Effective November 13th 2025
Download
Table of Contents
Avalara verpflichtet sich, die Privatsphäre von Personen zu schützen, deren personenbezogene Daten wir erheben („Sie“ oder „Ihr“). Avalara kann personenbezogene Daten von Personen sammeln, die sich registrieren, um die Dienste, Anwendungen und Programme von Avalara („Dienste“) zu nutzen, sowie von Personen, die unsere Website besuchen, Informationen anfordern, von potenziellen Kundinnen und Kunden und von Teilnehmenden unserer Veranstaltungen. Diese Datenschutzerklärung beschreibt, wie Avalara, seine Tochtergesellschaften und seine verbundenen Unternehmen („Avalara“ oder „wir“) personenbezogene Daten erheben, verwenden und offenlegen und welche Optionen Avalara hinsichtlich der Erhebung und Verwendung personenbezogener Daten bietet.
Erhobene personenbezogene Daten
Von Ihnen erhobene Daten:
Avalara erhebt personenbezogene Daten direkt von Ihnen, zum Beispiel wenn Sie sich über einen der Dienste von Avalara informieren oder eine E-Mail an Avalara senden, oder aus Ihren Interaktionen mit unserer Website, unseren Produkten oder Diensten. Zu den Details gehören:
Kategorie personenbezogener Daten
Zweck
Durch Datenverarbeitung ermöglichter Dienst
Kontaktdaten.
Wenn Sie sich nach unseren Diensten erkundigen, sich für eine Veranstaltung oder ein Seminar anmelden, Inhalte wie Whitepapers herunterladen, mit uns per E-Mail kommunizieren oder an einem Live-Chat teilnehmen, können wir Ihre Kontaktdaten wie Ihren Namen, Ihre Firma, Ihre Adresse, Ihre Telefonnummer, Ihre Faxnummer und Ihre E-Mail-Adresse erfassen. Wenn Ihr Unternehmen die Dienste nutzt und wir Ihnen ein Konto bereitstellen, können wir Ihren Namen, Ihre E-Mail-Adresse und die zugehörige IP-Adresse im Rahmen der Nutzung der Dienste durch Ihr Unternehmen erfassen.
Kontoerstellung, Anmeldung, Kontoverwaltung, dienstbezogene Kommunikation.
Rechnungsdaten.
Wenn Sie Dienste erwerben oder sich für eine Veranstaltung anmelden, können wir Rechnungs- und Zahlungsinformationen erfassen.
Ermöglichung des Kaufs von Diensten
Geräte- und Nutzungsdaten.
Wenn Sie unsere Website oder unsere Dienste nutzen, können wir auch automatisch Daten über Ihr Gerät sowie über Ihre Nutzung und Ihre Aktivitäten auf unserer Website und unseren Diensten erfassen. Zum Beispiel erfassen wir den Typ des Betriebssystems Ihres Geräts, die IP-Adresse, Geräteidentifikatoren, den Browsertyp, den Gerätetyp, den Domänennamen, die Zugriffszeiten und die Dauer des Besuchs sowie andere Informationen.
Dienst-Performance und Funktionalität
Sicherheit und Betrugsprävention
Analysen und Nutzungsinformationen
Personalisierung der Benutzererfahrung
Einhaltung von Vorschriften und Berichterstattung
Daten aus unseren mobilen Apps.
Wenn Sie unsere mobilen Dienste nutzen, erfassen wir möglicherweise Ihre Kontaktdaten, den geografischen Standort des Geräts, die geografischen Standorte, die Sie unseren Diensten zur Verfügung stellen, sowie geografische Gebiete, die von Ihrer IP-Adresse abgeleitet sind. Wir können auch Informationen über Ihre Rechnungen erfassen, z. B. Postadressen, Rechnungsnummern, Nummern der Freistellungszertifikate, Artikelbeschreibungen, Mengen und Beträge.
Ermöglichung der kontobezogenen Kommunikation
Bereitstellung standortbezogener Dienste
Rechnungsvorgang ermöglichen
Chat-Daten.
Wenn Sie einen Live-Chat starten, erstellt Avalara ein Protokoll über Ihre Interaktion mit den Chat-Agenten von Avalara.
Kundensupport und Problemlösung
Qualitätssicherung der Dienste und Schulungen der Vertreterinnen und Vertreter
Prüfung und rechtliche Compliance
Cookies und andere Technologien.
Wenn Sie auf unserer Website navigieren, können wir Cookies oder andere Technologien verwenden, um Daten über Ihr Gerät und Ihre Aktivitäten auf unserer Website zu erfassen. Für weitere Informationen über die von uns verwendeten Cookies und anderen Technologien, die von uns erfassten Daten und Ihre Optionen klicken Sie bitte hier.
Aufrechterhaltung von Benutzersitzungen während der Anmeldung
Serverleistung
Speichern von Benutzerschnittstellenanpassungen
Einwilligungsmanagement
Personenbezogene Daten aus anderen Quellen:
Avalara kann auch personenbezogene Daten aus anderen Quellen erfassen, einschließlich von Dritten, von denen wir Daten erworben haben, und wir können diese Daten mit Daten kombinieren, die wir bereits über Sie haben. Zum Beispiel können wir personenbezogene Daten von folgenden Parteien erheben:
Partnern. Avalara kann sich an gemeinsamen Marketingaktivitäten oder Veranstaltungssponsoring mit unseren Drittpartnern beteiligen, und wir können bei diesen Aktivitäten personenbezogene Daten über Sie erfassen. Wir erlauben Partnern auch, Avalara Personen zu empfehlen, die daran interessiert sind, mehr über die Dienste von Avalara zu erfahren. Wir verlassen uns darauf, dass unsere Partner Ihre Einwilligung einholen, bevor sie Ihre personenbezogenen Daten an uns weitergeben.
Dienstanbietern. Avalara kann auch mit Drittanbietern zusammenarbeiten, die uns helfen zu verstehen, wie unsere Kundinnen und Kunden die Dienste von Avalara nutzen.
So verwenden wir Ihre personenbezogenen Daten
Avalara verwendet Ihre Daten wie folgt:
Bei der Kommunikation mit Ihnen. Die Website von Avalara ermöglicht es Ihnen, Whitepapers herunterzuladen, Formulare auszufüllen, um weitere Informationen zu unseren Diensten zu erhalten, und mit uns über unsere Chat-Funktion in Kontakt zu treten. Sie können sich auch für die Teilnahme an Online-Seminaren oder Präsenzveranstaltungen anmelden. Wir verwenden diese Informationen, um Ihnen das angeforderte Material zur Verfügung zu stellen, um mit Ihnen über Ihr Interesse an den Diensten in Kontakt zu treten oder um Sie für die von Ihnen angeforderte Veranstaltung anzumelden. Wir können personenbezogene Daten auch verwenden, um Sie und Ihre Präferenzen zu verstehen, sodass wir Ihre Benutzererfahrung verbessern und Ihnen Informationen über Avalara, unsere verbundenen Unternehmen und unsere Partner senden können, z. B. Informationen über Werbeaktionen oder Veranstaltungen.
Avalara kann auch personenbezogene Daten aus anderen Quellen erhalten, darunter auch Dritte, von denen wir Daten erworben haben, und diese Daten mit den Daten kombinieren, die wir bereits über Sie haben. Dies hilft uns, unsere Aufzeichnungen zu aktualisieren, zu erweitern und zu analysieren, neue Kundinnen und Kunden zu identifizieren und gezieltere Werbung zu erstellen, um Produkte und Dienste anzubieten, die für Sie von Interesse sein könnten.
Wenn Sie Avalara auf Social-Media-Websites Dritter folgen oder „liken“, können wir Ihr öffentliches Profil sehen und Werbung direkt an Sie richten.
Werbung. Wir können über Cookies und andere Technologien erfasste Daten verwenden, um unsere Werbung auf anderen Seiten zu verwalten oder Ihnen Angebote oder Werbeanzeigen, einschließlich für Dienste von Drittanbietern, basierend auf Ihren Browsing-Aktivitäten und Interessen bereitzustellen. Für weitere Details klicken Sie bitte hier.
Rechtsgrundlagen für die Datenverarbeitung (Benutzer im EWR und im Vereinigten Königreich). Wir erfassen und verarbeiten Informationen über Benutzer mit Sitz im Europäischen Wirtschaftsraum („EWR“) und im Vereinigten Königreich („UK“), wenn wir die Grundlage haben, dies gemäß den geltenden Gesetzen zu tun. Avalara stützt sich bei der Verarbeitung Ihrer Daten auf eine der folgenden vier Rechtsgrundlagen:
Vertrag. Wenn Sie oder Ihr Unternehmen einen Vertrag mit uns abschließen, werden wir Ihre Daten verarbeiten, um die Bedingungen unseres Vertrags zu erfüllen.
Berechtigtes Interesse. Wir haben ein berechtigtes Interesse daran, die Sicherheit und den Schutz unserer Dienste zu gewährleisten, die Dienste zu betreiben und zu verbessern, unsere Kundinnen und Kunden zu unterstützen, die Dienste zu vermarkten und zu bewerben sowie unsere Interessen zu schützen.
Einwilligung. In einigen Fällen erteilen Sie uns die Einwilligung, Ihre Daten für einen bestimmten Zweck zu verwenden.
Gesetzliche Verpflichtung. Wir sind möglicherweise verpflichtet, Ihre Daten zu verarbeiten, um einer gesetzlichen Verpflichtung nachzukommen.
Benutzer im EWR- und im Vereinigten Königreich haben eine Reihe von Rechten in Bezug auf ihre von Avalara verarbeiteten personenbezogenen Daten. Personen, die im EWR oder Vereinigten Königreich wohnen, können eine Zusammenfassung dieser Rechte in dieser Datenschutzerklärung einsehen.
So speichern wir Ihre personenbezogenen Daten
Speicherung und Löschung von Daten. Avalara und unsere Dienstanbieter speichern die personenbezogenen Daten von Benutzern im EWR und Vereinigten Königreich für die Zeit, die erforderlich ist, um die Zwecke zu erreichen, für die die Informationen erfasst werden, gemäß den geltenden Datenschutzgesetzen. Wenn wir Ihre personenbezogenen Daten nicht mehr speichern oder verwenden müssen, um vertraglichen, gesetzlichen oder behördlichen Verpflichtungen nachzukommen, denen wir unterliegen (zum Beispiel gesetzliche Aufbewahrungsfristen oder Aufbewahrung von Nachweisen innerhalb der gesetzlichen Verjährungsfristen) oder für andere Zwecke gemäß geltendem Recht, werden wir sie aus unseren Systemen und Aufzeichnungen entfernen oder Schritte unternehmen, um sie ordnungsgemäß zu anonymisieren, sodass Sie nicht mehr identifiziert werden können.
Warum wir personenbezogene Daten weitergeben
Dienstanbieter. Avalara kann Ihre Daten an unsere beauftragten Dienstanbieter und Lieferanten weitergeben, damit diese Dienstanbieter und Lieferanten Dienste in unserem Namen erbringen können. Beispielsweise nutzen wir eine Customer Relationship Management-Plattform oder Datenanalyseplattform von Drittanbietern, um Daten zu organisieren und unsere Kunden und potenziellen Kunden besser zu verstehen. Diese Dienstanbieter sind nur insoweit befugt, Ihre Daten zu verwenden, wie es für die Erbringung der von uns angeforderten Dienste erforderlich ist. Wir können personenbezogene Daten auch an soziale Netzwerke wie LinkedIn weitergeben, um auf diesen Websites Marketing und Werbung zu betreiben. Sofern in dieser Datenschutzerklärung nicht anders beschrieben, teilt, verkauft, vermietet oder handelt Avalara keine Daten mit Dritten zu deren Werbezwecken.
Verbundene Unternehmen und Tochtergesellschaften.Wir können Ihre Daten an unsere Tochtergesellschaften und verbundenen Unternehmen (die Unternehmen unter gemeinsamer Kontrolle) weitergeben, um die von Ihnen angeforderten Dienste zu erbringen, wie z. B. Kundenservice, Marketing, technische Operationen und Kontoverwaltungszwecke.
Avalara-Partner. Das umfangreiche Partnernetzwerk von Avalara bietet eine breite Palette von Integrationen, die es unseren Dienste ermöglichen, sich mit Software von Drittanbietern zu verbinden. Wir können Ihre Daten an diese Partner weitergeben, um unsere gemeinsamen Kunden und Kundinnen zu unterstützen. Wir können Ihre Daten auch an Partner von uns weitergeben, die Veranstaltungen mitfinanzieren, an denen Sie teilnehmen möchten.
Abrechnung. Avalara nutzt einen Drittanbieter-Service, um die Kreditkartenverarbeitung zu verwalten. Diesem Dienstanbieter ist es nicht gestattet, Rechnungsdaten zu speichern, aufzubewahren oder zu verwenden, außer zum alleinigen Zweck der Kreditkartenverarbeitung in unserem Namen.
Erzwungene Offenlegung. Avalara behält sich das Recht vor, Ihre Daten weiterzugeben, wenn dies gesetzlich vorgeschrieben ist oder um einem Gerichtsverfahren, einem Gerichtsbeschluss oder einem gültigen Rechtsverfahren nachzukommen. Wir können Ihre Daten zudem offenlegen, um die Rechte und das Eigentum von Avalara, unseren Vertretungen, Mitarbeitenden, Partnern, Kundinnen und Kunden zu schützen, unter anderem, um einen Angriff auf unsere Systeme oder unser Netzwerk zu verhindern oder zu stoppen oder um Spam oder Versuche, unsere Benutzerinnen und Benutzer zu betrügen, zu verhindern. Schließlich müssen wir Ihre Daten möglicherweise auch im Zusammenhang mit oder während der Verhandlung einer Fusion, Finanzierung, Übernahme, Insolvenz, Auflösung, Transaktion oder eines Verfahrens im Zusammenhang mit dem Verkauf, der Übertragung, der Veräußerung oder der Offenlegung unseres gesamten Geschäfts oder Vermögens oder eines Teils davon an ein anderes Unternehmen offenlegen.
Ihre Rechte als betroffene Person
Personen mit Wohnsitz im Europäischen Wirtschaftsraum („EWR“) und im Vereinigten Königreich haben eine Reihe von Rechten in Bezug auf ihre von Avalara verarbeiteten personenbezogenen Daten. Diese sind im Folgenden zusammengefasst. Bitte beachten Sie, dass die Ausübung dieser Rechte bestimmten Anforderungen und Bedingungen unterliegt, wie in den geltenden Gesetzen festgelegt. Diese Rechte können unter bestimmten Umständen auch eingeschränkt sein, z. B. wenn die Erfüllung einer Anfrage personenbezogene Daten über eine andere Person preisgeben oder die Rechte einer anderen Person (einschließlich Avalara) verletzen würde oder wenn eine Person uns auffordert, Daten zu löschen, zu deren Aufbewahrung wir gesetzlich verpflichtet sind oder an deren Aufbewahrung wir ein zwingendes berechtigtes Interesse haben. Relevante Ausnahmen sind, soweit zutreffend, in der Verordnung (EU) 2016/679 (der Datenschutz-Grundverordnung oder „DSGVO“), der im Vereinigten Königreich beibehaltenen Version der DSGVO, wie sie durch den Data Protection Act 2018 umgesetzt wurde, und in den geltenden lokalen Gesetzen enthalten. Wir werden Personen über alle relevanten Ausnahmen informieren, auf die wir uns bei der Beantwortung von eingegangenen Anfragen stützen.
Auskunftsrecht: Sie haben das Recht, von Avalara eine Bestätigung darüber zu erhalten, ob Ihre personenbezogenen Daten verarbeitet werden, und, wenn dies der Fall ist, Zugang zu Ihren personenbezogenen Daten zu verlangen. Die Zugangsinformationen umfassen – unter anderem – die Zwecke der Verarbeitung, die Kategorien der betroffenen personenbezogenen Daten und die Empfänger oder Kategorien von Empfängern, denen gegenüber die personenbezogenen Daten offengelegt wurden oder offengelegt werden. Sie haben das Recht, eine Kopie der personenbezogenen Daten zu erhalten, die verarbeitet werden. Vorbehaltlich der geltenden Gesetze können wir, basierend auf den Verwaltungskosten, eine angemessene Gebühr für Kopien erheben.
Recht auf Berichtigung: Sie haben das Recht, von Avalara die Berichtigung falscher personenbezogener Daten, die Sie betreffen, zu verlangen. Je nach Zweck der Verarbeitung haben Sie möglicherweise das Recht, die Vervollständigung unvollständiger personenbezogener Daten zu verlangen, auch durch eine ergänzende Erklärung.
Recht auf Löschung („Recht auf Vergessenwerden“): Sie haben das Recht, von Avalara das Löschen Ihrer personenbezogenen Daten zu verlangen.
Recht auf Einschränkung der Verarbeitung: Sie haben das Recht, die Einschränkung der Verarbeitung Ihrer personenbezogenen Daten zu verlangen. In diesem Fall würden diese Daten markiert und von Avalara nur für bestimmte Zwecke verarbeitet werden.
Recht auf Datenübertragbarkeit: Sie haben das Recht, die personenbezogenen Daten, die Sie Avalara zur Verfügung gestellt haben, in einem strukturierten, gängigen und maschinenlesbaren Format zu erhalten, und Sie haben das Recht, die personenbezogenen Daten ohne Behinderung durch uns an eine andere Stelle zu übermitteln.
Widerspruchsrecht: Sie haben möglicherweise das Recht, aus Gründen, die sich aus Ihrer besonderen Situation ergeben, jederzeit gegen die Verarbeitung Ihrer personenbezogenen Daten durch Avalara Widerspruch einzulegen, und wir können verpflichtet sein, Ihre personenbezogenen Daten nicht mehr zu verarbeiten. Wenn Sie ein Widerspruchsrecht haben und dieses Recht ausüben, werden Ihre personenbezogenen Daten von Avalara für solche Zwecke nicht mehr verarbeitet. Die Ausübung dieses Rechts verursacht keine Kosten. Ein solches Widerspruchsrecht besteht möglicherweise nicht, insbesondere wenn die Verarbeitung Ihrer personenbezogenen Daten erforderlich ist, um vor Vertragsschluss Maßnahmen zu ergreifen oder einen bereits geschlossenen Vertrag zu erfüllen.
Wenn Sie diese Rechte ausüben möchten oder wenn Sie Fragen oder Beschwerden zu dieser Mitteilung haben, senden Sie uns bitte eine E-Mail an dataprivacy@avalara.com.
Sie haben auch das Recht, eine Beschwerde bei der zuständigen Aufsichtsbehörde für Datenschutzfragen einzureichen.
So verwalten wir Ihre personenbezogenen Daten
Kommunikationspräferenzen. Wenn Sie von Avalara Werbemitteilungen per E-Mail erhalten haben und zukünftige Mitteilungen abbestellen möchten, können Sie auf den Link „Abbestellen“ klicken, der sich am Ende der E-Mail-Nachricht befindet, oder Sie können hier klicken. Wenn Sie den Erhalt von Werbemitteilungen abbestellen, erhalten Sie möglicherweise weiterhin Transaktionsnachrichten zu Servicemitteilungen, Aktualisierungen unserer Nutzungsbedingungen oder unserer Datenschutzerklärung oder zu unserer laufenden Beziehung. Um sich von anderen Kommunikationsformen abzumelden, können Sie uns kontaktieren, indem Sie die Informationen im nachfolgenden Abschnitt „Kontakt“ verwenden.
Verwaltung personenbezogener Daten. Avalara bietet verschiedene Konten mit unterschiedlichen Funktionen, je nachdem, auf welche Dienste die Benutzer und Benutzerinnen zugreifen. Avalara-Konten ermöglichen es Ihnen in der Regel, Ihre Benutzereinstellungen oder Ihr Profil zu aktualisieren, indem Sie sich mit Ihrem Benutzernamen und Passwort auf der entsprechenden Website oder dem entsprechenden Dienst anmelden. Wenn Sie kein Konto haben, aber eine Anfrage zur Verwaltung Ihrer Daten stellen möchten, können Sie sich über die Informationen im nachfolgenden Abschnitt „Kontakt“ an Avalara wenden.
Anfragen zur Verwaltung Ihrer Daten werden innerhalb eines angemessenen Zeitraums bearbeitet. Wenn Sie ein Mitarbeiter oder eine Mitarbeiterin eines Avalara-Kunden oder einer Avalara-Kundin sind, können Sie sich auch an den Systemadministrator Ihres Unternehmens wenden, um Unterstützung bei der Verwaltung Ihrer Daten zu erhalten.
Kalifornische Datenschutzrechte
Bewohner Kaliforniens können die Angaben zum California Consumer Privacy Act von Avalara hier einsehen.
Internationale Übertragung personenbezogener Daten
Avalara kann Ihre Daten in Ihrer Region verarbeiten und speichern oder wir können sie in die Vereinigten Staaten oder in andere Länder übertragen, in denen wir Tochtergesellschaften, Niederlassungen oder Dienstanbieter haben. Eine Liste unserer globalen Niederlassungen finden Sie hier. Wir können Daten aus dem Europäischen Wirtschaftsraum und der Schweiz in andere Länder übertragen. Wenn wir das tun, verwenden wir rechtliche Mechanismen wie Verträge, um sicherzustellen, dass ein angemessener Übertragungsmechanismus vorhanden ist.
Datenverantwortlicher
Wenn Sie im EWR oder im Vereinigten Königreich wohnen, ist Avalara Europe Ltd mit Sitz in Lanchester House, First Floor, Trafalgar Place, Brighton, Vereinigtes Königreich, BN1 4FU, der Verantwortliche für Ihre personenbezogenen Daten.
Für alle anderen Personen ist Avalara, Inc.mit Sitz in 512 S Mangum St #100, Durham, NC 27701, USA, der Verantwortliche für Ihre personenbezogenen Daten. Unsere Telefonnummer ist 1-877-814-9390.
Überwachung eingehender E-Mails
Alle eingehenden E-Mails, die an Avalara-E-Mail-Konten gesendet werden, werden archiviert und können von Avalara und/oder unseren externen Dienstanbietern gescannt werden, um Bedrohungen für unsere Systeme zu erkennen und zu verhindern, illegales oder unangemessenes Verhalten zu untersuchen und/oder unerwünschte Werbe-E-Mails („Spam“) zu entfernen. Wenn Sie Bedenken bezüglich dieses Prozesses haben, kontaktieren Sie uns bitte.
Änderungen an dieser Datenschutzerklärung
Avalara behält sich das Recht vor, diese Datenschutzerklärung zu ändern. Wenn wir Änderungen an der Datenschutzerklärung vornehmen, werden wir diese Seite aktualisieren und das vorstehende Datum unter „zuletzt aktualisiert“ ändern.
Kontakt
Wenn Sie Fragen oder Beschwerden zu dieser Datenschutzerklärung haben, senden Sie uns bitte eine E-Mail an dataprivacy@avalara.com.
EEA & United Kingdom Privacy Notice FR Version
Version
Effective November 13th 2025
Download
Table of Contents
Avalara s’engage à protéger la confidentialité des personnes dont nous collectons les données personnelles (ci-après « vous », « votre » ou « vos »). Avalara est susceptible de collecter des données personnelles auprès des personnes qui s’inscrivent pour utiliser les services, applications et programmes d’Avalara (ci-après les « Services »), des visiteurs sur notre site Web, des personnes qui demandent des informations, des clients potentiels et des participants à des événements. Le présent Avis de confidentialité décrit comment Avalara et ses filiales et sociétés affiliées (ci-après « Avalara » ou « nous ») collectent, utilisent et divulguent des données personnelles, ainsi que les choix qu’Avalara propose concernant sa collecte et son utilisation de données personnelles.
Données personnelles collectées
Données collectées auprès de vous :
Avalara collecte des données personnelles directement auprès de vous, par exemple lorsque vous vous renseignez sur l’un des Services d’Avalara ou que vous envoyez un e-mail à Avalara, ou à la suite de vos interactions avec notre site Web, nos produits ou nos Services. Les détails incluent ce qui suit :
Catégorie de données personnelles
Finalité
Service activé par le traitement des données
Coordonnées
Lorsque vous vous renseignez sur nos Services, vous inscrivez à un événement ou à un séminaire, téléchargez du contenu comme des livres blancs, communiquez avec nous par e-mail, ou participez à une messagerie instantanée, nous sommes susceptibles de collecter vos coordonnées, telles que votre nom, votre société, votre adresse, votre numéro de téléphone, votre numéro de fax et votre adresse électronique. Si votre société utilise les Services et que nous vous fournissons un compte, nous sommes susceptibles de collecter votre nom, votre adresse électronique et l’adresse IP associée dans le cadre de l’utilisation des Services par votre société.
Création de comptes, connexion, gestion de comptes, communications liées au Service.
Données de facturation
Lorsque vous achetez des Services ou vous inscrivez pour assister à un événement, nous sommes susceptibles de collecter des informations de facturation et de paiement.
Facilitation de l’achat de services
Données sur l’appareil et l’utilisation
Lorsque vous utilisez notre site Web ou nos Services, nous sommes également susceptibles de collecter automatiquement des données relatives à votre appareil, à votre utilisation et aux activités que vous menez sur notre site Web et par rapport à nos Services. Par exemple, nous collectons le type de système d’exploitation de votre appareil, l’adresse IP, les identifiants de l’appareil, le type de navigateur, le type d’appareil, le nom de domaine, les heures d’accès, la durée de la visite et d’autres informations.
Performance et fonctionnalité du Service
Sécurité et prévention des fraudes
Analyses et informations sur l’utilisation
Personnalisation de l’expérience utilisateur
Conformité et rapports
Données de nos applications mobiles
Lorsque vous utilisez nos Services mobiles, nous sommes susceptibles de collecter vos coordonnées, l’emplacement géographique de l’appareil, les emplacements géographiques que vous fournissez à nos Services, ainsi que les zones géographiques dérivées de votre adresse IP. Nous sommes également susceptibles de collecter des informations sur vos factures telles que les adresses postales, les numéros de facture, les numéros de certificat d’exemption, les descriptions d’articles, les quantités et les montants.
Facilitation de la communication liée au compte
Fourniture de Services basés sur la localisation
Facilitation du processus de facturation
Données de messagerie instantanée
Lorsque vous démarrez une conversation sur la messagerie instantanée, Avalara collecte un journal de votre interaction avec les agents de messagerie instantanée d’Avalara.
Support client et résolution de problèmes
Assurance qualité des Services et formation des agents
Audit et conformité juridique
Cookies et autres technologies
Lorsque vous naviguez sur notre site Web, nous sommes susceptibles d’utiliser des cookies ou d’autres technologies pour collecter des données sur votre appareil et votre activité sur notre site Web. Pour de plus amples informations sur les cookies et autres technologies que nous utilisons, les données que nous collectons et vos choix, cliquez ici.
Gestion des sessions utilisateur pendant la connexion
Performance du serveur
Sauvegarde des personnalisations de l’interface utilisateur
Gestion du consentement
Données personnelles collectées auprès d’autres sources :
Avalara est également susceptible de collecter des données personnelles provenant d’autres sources, y compris des tiers auprès desquels nous avons acheté des données, et nous sommes susceptibles de combiner ces données avec celles que nous avons déjà à votre sujet. Par exemple, nous sommes susceptibles de collecter des données personnelles à partir des sources suivantes :
Partenaires : Avalara est susceptible de prendre part à des activités conjointes de marketing ou à des parrainages d’événements avec ses partenaires tiers et de collecter des données personnelles vous concernant à partir de ces activités. Nous permettons également à ces partenaires d’orienter vers Avalara des personnes susceptibles de souhaiter en savoir plus sur les Services d’Avalara. Nous comptons sur nos partenaires pour obtenir votre autorisation avant de partager vos données personnelles avec nous.
Prestataire de services : Avalara est également susceptible de collaborer avec des prestataires de services tiers qui l’aident à comprendre comment ses clients utilisent les Services d’Avalara.
Utilisation de vos données personnelles
Avalara utilise vos données comme suit :
Communiquer avec vous : le site Web d’Avalara vous permet de télécharger des livres blancs, de remplir des formulaires pour obtenir plus de détails sur nos Services et de communiquer avec nous via notre fonctionnalité de messagerie instantanée. Vous pouvez également vous inscrire pour assister à des séminaires en ligne ou à des événements en personne. Nous utilisons ces informations pour vous fournir les supports que vous avez demandés, pour réaliser un suivi avec vous concernant votre intérêt pour les Services ou pour vous inscrire à l’événement auquel vous souhaitez participer. Nous sommes également susceptibles d’utiliser des données personnelles pour vous comprendre, ainsi que vos préférences, afin d’améliorer votre expérience et de vous envoyer des informations sur Avalara, nos sociétés affiliées et nos partenaires, telles que des informations sur des promotions ou des événements.
Avalara est également susceptible de recevoir des données personnelles provenant d’autres sources, y compris des tiers auprès desquels nous avons acheté des données, et de les combiner avec les données que nous avons déjà à votre sujet. Cela nous permet de mettre à jour, d’élargir et d’analyser nos dossiers, d’identifier de nouveaux clients et de créer des publicités plus personnalisées afin de fournir des produits et des services qui pourraient vous intéresser.
Si vous êtes abonné à des canaux d’Avalara sur des sites de réseaux sociaux tiers, nous pouvons voir votre profil public et sommes susceptibles d’afficher de la publicité pour vous.
Publicité : Nous sommes susceptibles d’utiliser les données collectées via des cookies et d’autres technologies afin de gérer notre publicité sur d’autres sites ou pour vous fournir des offres ou des annonces, y compris pour des services tiers, en fonction de vos activités de navigation et de vos intérêts. Pour de plus amples détails à ce sujet, cliquez ici.
Bases juridiques du traitement (utilisateurs de l’EEE et du Royaume-Uni) : Nous collectons et traitons des informations sur les utilisateurs situés dans l’Espace économique européen (EEE) et au Royaume-Uni lorsque nous disposons d’une base juridique pour ce faire en vertu de la législation applicable. Avalara s’appuie sur l’une des quatre bases juridiques suivantes pour le traitement de vos données :
Contrat : Lorsque vous ou votre société concluez un accord avec nous, nous traitons vos données pour respecter les dispositions de notre contrat.
Intérêt légitime : Nous avons un intérêt légitime à protéger la sécurité et la sûreté de nos Services, à faire fonctionner et à améliorer les Services, à soutenir nos clients, à commercialiser et à promouvoir les Services et à protéger nos intérêts.
Consentement : Dans certains cas, vous nous donnerez votre consentement pour utiliser vos données à une fin spécifique.
Exigence légale : Nous pourrions être tenus de traiter vos données pour nous conformer à une exigence légale.
Les utilisateurs de l’EEE et du Royaume-Uni possèdent plusieurs droits liés à leurs données personnelles traitées par Avalara. Les personnes résidant dans l’EEE ou au Royaume-Uni peuvent consulter un résumé de ces droits dans le présent Avis de confidentialité.
Conservation de vos données personnelles
Conservation et suppression des données : Avalara et nos prestataires de services conservent les données personnelles des utilisateurs de l’EEE et du Royaume-Uni pendant le temps nécessaire pour atteindre les objectifs pour lesquels les informations sont collectées, conformément aux lois applicables en matière de protection des données. Lorsque nous n’avons plus besoin de stocker ou d’utiliser vos données personnelles pour respecter des obligations contractuelles, juridiques ou réglementaires auxquelles nous sommes soumis (par exemple, les périodes de conservation imposées par la législation ou si nous en avons besoin pour préserver des preuves dans le cadre des délais de prescription légaux) ou pour d’autres raisons conformément à la législation applicable, nous les supprimons de nos systèmes et enregistrements ou prenons des mesures pour les anonymiser correctement afin de supprimer toute possibilité de vous identifier à partir de ces données.
Raison du partage des données personnelles
Prestataire de services : Avalara est susceptible de partager vos données avec nos prestataires de services et fournisseurs sous contrat afin que ceux-ci puissent effectuer des services pour notre compte. Par exemple, nous utilisons une plateforme tierce de gestion de la relation client ou une plateforme tierce d’analyse des données pour organiser les données et mieux comprendre nos clients et clients potentiels. Ces prestataires de services sont autorisés à utiliser vos données uniquement au besoin pour nous fournir les services demandés. Nous sommes également susceptibles de partager des données personnelles avec des sites de réseaux sociaux tiers, tels que LinkedIn, dans le cadre de nos activités de marketing et de publicité sur ces sites. Sauf mention contraire contenue dans le présent Avis de confidentialité, Avalara ne partage, ne vend, ne loue ni n’échange aucune donnée avec des tiers à des fins promotionnelles.
Filiales et sociétés affiliées : Nous sommes susceptibles de partager vos données avec nos filiales et sociétés affiliées (ces entités étant sous contrôle commun) afin de fournir les Services que vous demandez, tels que le support client, le marketing, les opérations techniques et la gestion des comptes.
Partenaires d’Avalara : Le réseau étendu de partenaires d’Avalara propose une large gamme d’intégrations qui permettent à nos Services de s’interconnecter avec des logiciels tiers. Nous sommes susceptibles de partager vos données avec ces partenaires pour soutenir nos clients mutuels. Nous sommes également susceptibles de partager vos données avec nos partenaires qui co-parrainent des événements auxquels vous choisissez d’assister.
Facturation : Avalara utilise un prestataire de services tiers pour gérer le traitement des cartes de crédit. Ce prestataire de services n’est pas autorisé à stocker, à conserver ou à utiliser des informations de facturation, sauf dans le seul but de traiter les cartes de crédit pour notre compte.
Divulgation forcée : Avalara se réserve le droit de partager vos données si la législation l’exige ou pour se conformer à une procédure judiciaire, à l’ordonnance d’un tribunal ou à un processus juridique valide. Nous sommes également susceptibles de divulguer vos données pour protéger les droits et la propriété d’Avalara, de nos agents, employés, partenaires et clients, y compris pour prévenir ou arrêter une attaque sur nos systèmes ou notre réseau ou pour empêcher la diffusion de courrier indésirable ou les tentatives de fraude à l’encontre de nos utilisateurs. Enfin, nous sommes également susceptibles de divulguer vos données dans le cadre ou pendant la négociation de tout financement, fusion, acquisition, faillite, dissolution, transaction ou procédure impliquant la vente, le transfert, la cession ou la divulgation de tout ou partie de nos activités ou actifs à une autre société.
Vos droits en tant que personne concernée
Les personnes résidant dans l’Espace économique européen (EEE) et au Royaume-Uni jouissent de plusieurs droits concernant leurs données personnelles traitées par Avalara. Ces droits sont résumés ci-dessous. Veuillez noter que l’exercice de ces droits est soumis à certaines exigences et conditions définies dans la législation applicable. Ces droits peuvent également être limités dans certaines circonstances, par exemple si la satisfaction d’une demande venait à révéler des informations personnelles identifiables au sujet d’une autre personne, auquel cas il serait porté atteinte aux droits d’une autre personne (y compris Avalara), ou si une personne nous demandait de supprimer des informations que nous sommes contraints de conserver en vertu de la législation ou pour des intérêts légitimes impérieux. Des exemptions pertinentes figurent, le cas échéant, dans le règlement (UE) 2016/679 (le règlement général sur la protection des données ou RGPD), la version conservée du RGPD du Royaume-Uni telle qu’implémentée par la Loi sur la protection des données de 2018, et les lois locales applicables. Nous nous engageons à informer ces personnes de toute exemption pertinente dans notre réponse à toute demande reçue.
Droit d’accès : Vous avez le droit d’obtenir d’Avalara la confirmation que vos données personnelles sont ou traitées et, lorsqu’elles le sont, de demander l’accès à vos données personnelles. Celles-ci comprennent notamment les finalités du traitement, les catégories de données personnelles concernées, ainsi que les destinataires ou catégories de destinataires auxquels les données personnelles ont été ou seront communiquées. Vous avez le droit d’obtenir une copie des données personnelles faisant l’objet d’un traitement. Sous réserve de la législation applicable, nous sommes susceptibles de facturer des frais raisonnables pour toute copie, basés sur les coûts administratifs.
Droit de rectification : Vous avez le droit d’obtenir d’Avalara la rectification des données personnelles vous concernant qui sont inexactes. Selon les finalités du traitement, vous pouvez avoir le droit de compléter des données personnelles incomplètes, y compris en fournissant une déclaration complémentaire.
Droit à l’effacement (droit à l’oubli) : Vous avez le droit de demander à Avalara d’effacer vos données personnelles.
Droit à la limitation du traitement : Vous avez le droit de demander la limitation du traitement de vos données personnelles, auquel cas elles seraient marquées et traitées par Avalara uniquement à certaines fins.
Droit à la portabilité des données : Vous avez le droit de recevoir les données personnelles que vous avez fournies à Avalara dans un format structuré, couramment utilisé et lisible par machine, et vous avez le droit de transmettre ces données personnelles à une autre entité sans que nous y fassions obstacle.
Droit d’opposition : Vous avez le droit de vous opposer, à tout moment, pour des raisons tenant à votre situation particulière, à un traitement de vos données personnelles par Avalara, et nous pouvons être tenus de ne plus traiter vos données personnelles. Si vous avez le droit de vous opposer et que vous exercez ce droit, vos données personnelles ne seront plus traitées à de telles fins par Avalara. L’exercice de ce droit n’entraîne aucun coût. Un tel droit d’opposition peut ne pas exister, en particulier si le traitement de vos données personnelles est nécessaire pour prendre des mesures préalables à la conclusion d’un contrat ou pour exécuter un contrat déjà conclu.
Si vous souhaitez exercer ces droits, ou si vous avez des questions ou des réclamations concernant le présent avis, veuillez nous envoyer un e-mail à l’adresse dataprivacy@avalara.com.
Vous avez également le droit de déposer une plainte auprès de l’autorité de contrôle compétente en matière de protection des données.
Gestion de vos données personnelles
Préférences de communication : Si vous avez reçu par e-mail des communications promotionnelles d’Avalara et souhaitez vous désinscrire de toute communication future, vous pouvez cliquer sur le lien « se désinscrire » situé en bas des e-mails ou vous rendre ici. Si vous vous désabonnez de la réception des communications promotionnelles, vous pourriez toujours recevoir des messages transactionnels relatifs aux notifications de Services, aux mises à jour de nos conditions générales ou de notre Avis de confidentialité ou à la poursuite de notre relation. Pour vous désinscrire d’autres formes de communication, vous pouvez vous désinscrire en nous contactant en utilisant les informations dans la section « Nous contacter » ci-dessous.
Gestion des données personnelles : Avalara fournit différents comptes associés à des fonctionnalités variées en fonction des Services auxquels les utilisateurs accèdent. Les comptes Avalara vous permettent généralement de mettre à jour vos paramètres ou votre profil utilisateur en vous connectant au site Web ou au Service applicable avec votre nom d’utilisateur et votre mot de passe. Si vous n’avez pas de compte mais souhaitez faire une demande pour gérer vos données, vous pouvez contacter Avalara en utilisant les informations dans la section « Contactez-nous » ci-dessous.
Les demandes de gestion de vos données seront traitées dans un délai raisonnable. Si vous êtes un employé d’un client Avalara, vous pouvez également contacter l’administrateur système de votre société pour obtenir de l’aide pour gérer vos données.
Droits de confidentialité en Californie
Les résidents de Californie peuvent consulter ici les informations fournies par Avalara dans le cadre de la loi California Consumer Privacy Act.
Transferts internationaux de données personnelles
Avalara est susceptible de traiter et de stocker vos données dans votre région ou de les transférer aux États-Unis ou dans d’autres pays où la société possède des filiales, des sociétés affiliées ou collabore avec des prestataires de services. Vous trouverez ici une liste de nos bureaux dans le monde entier. Nous sommes susceptibles de transférer des données depuis l’EEE et la Suisse vers d’autres pays et, à cet effet, nous mettons en œuvre des mécanismes juridiques tels que des contrats pour nous assurer qu’un mécanisme de transfert adéquat est en place.
Responsable du traitement
Si vous résidez dans l’EEE ou au Royaume-Uni, Avalara Europe Ltd, situé à Lanchester House, First Floor, Trafalgar Place, Brighton, Royaume-Uni, BN1 4FU, est le responsable du traitement de vos données personnelles.
Pour toutes les autres personnes, Avalara, Inc., situé au 512 S Mangum St #100, Durham, NC 27701, États-Unis, agit en tant que responsable du traitement de vos données personnelles. Notre numéro de téléphone est le 1-877-814-9390.
Surveillance des e-mails entrants
Tous les e-mails entrants envoyés aux comptes de courrier électronique d’Avalara sont archivés et peuvent être scannés par Avalara et/ou nos prestataires de services externes afin de détecter et de prévenir les menaces sur nos systèmes, d’enquêter sur des comportements illégaux ou inappropriés et/ou d’éliminer les e-mails promotionnels non sollicités (spam). Si vous avez des préoccupations au sujet de ce processus, veuillez nous contacter.
Modifications apportées au présent Avis de confidentialité
Avalara se réserve le droit de modifier le présent Avis de confidentialité. Lorsque nous apportons des modifications à l’Avis de confidentialité, nous mettons à jour cette page et changerons la date de dernière mise à jour ci-dessus.
Nous contacter
Si vous avez des questions ou des réclamations concernant le présent Avis de confidentialité, veuillez nous envoyer un e-mail à l’adresse dataprivacy@avalara.com.
US Privacy Notice
Version
Effective August 24th 2026
Download
Table of Contents
US Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.aboutads.info/ for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The Network Advertising Initiative similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://thenai.org/how-to-opt-out/ to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 21st 2025 to August 24th 2026
Download
Table of Contents
US Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 20th 2025 to October 21st 2025
Download
Table of Contents
US Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective October 20th 2025 to October 20th 2025
Download
Table of Contents
US Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.
Effective August 5th 2025 to October 20th 2025
Download
Table of Contents
US Privacy Notice
Avalara, Inc., is committed to protecting the privacy of individuals whose personal data we collect (“you” or “your”). Avalara may collect personal data from individuals who register to use Avalara’s services, applications, and programs (“Services”), visitors to our website, individuals who request information, prospective customers, and event attendees. This Privacy Notice describes how Avalara and its subsidiaries and affiliated companies (“Avalara” or “we”) collect, use, and disclose personal data, and the choices Avalara offers regarding its collection and use of personal data.
We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.
This Privacy Notice does not address our privacy practices relating to Avalara job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.
Our Role in Processing Personal Data
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.
This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use the Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.
If you access our services or otherwise interact with us from the European Economic Area, United Kingdom, or Switzerland, please see the Data Controller section of this Privacy Notice for more information about our legal entities operating as the controllers of your personal data.
Personal Data Collected
Avalara may collect personal data from you in different ways depending on how you interact with us and the Services. We also may collect personal data automatically when you interact with our websites or Services and may also collect personal data from other sources and third parties.
Data collected from you:
Avalara collects personal data directly from you, for instance when you inquire about one of Avalara’s Services or send an email to Avalara, or from your interactions with our website, products or Services. Details include:
Contact details. When you inquire about our Services, register for an event or seminar, download content like white papers, communicate with us by email, or enter a live chat, we may collect your contact details, such as your name, company, address, phone number, fax number, and email address.
Account creation. When you create an account with us via our website, we may collect your contact details and a password.
Billing and invoice data. When you purchase Services or register to attend an event, we may collect billing and payment information, including payment card information, billing address, and other financial information (such as routing and account number). We may also collect information about your invoices such as postal addresses, invoice numbers, exemption certificate numbers, item descriptions, quantities, and amounts. Please note that we use third-party payment provider CyberSource and Fiserv, to process payments made to us (“Third Party Processors”). We do not retain do not retain any personally identifiable financial information, such as payment card number, you provide these third-party payment providers in connection with payments. Rather, all such information is provided directly by you to our third-party payment providers. The payment provider’s use of your personal data is governed by their privacy notice.
Third Party Processors’ privacy policies can be found here:
Privacy-notice | Fiserv.
Visa Global Privacy Notice | Visa.
Feedback and support data. When you communicate with us, we may collect the contents of custom messages sent through the forms, chat platforms, including our online live chat or automated chat functions, email addresses, or other contact information we make available to customers, as well as recordings of calls with us, where permitted by law (including through the use of automated tools provided by us or our third-party providers).
Personal data we automatically collect:
We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our products and services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our services or otherwise engage with us:
Device and usage data. When you use our website or our Services, we may automatically collect data about your device and about your usage of and activity on our website and Services. For example, we collect your device’s operating system type, IP address, device identifiers (such as a persistent device identifier or advertising ID, browser type, device type, domain name, access times, and the duration of visit, and other information. We employ third-party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
Interaction data. When you use our website or Services, we may collect information about your interactions, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our products or services, or engage in chat features or other communication platforms we provide
Location data. When you use our website or mobile Services, we and our third-party providers may collect your contact details, the geographic location of the device, the geographic locations you provide to our Services, and geographic areas derived from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features such as live and automated chat, and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.
For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the How to Manage Your Personal Data section below. For more information about the Cookies and Other Technologies we use, the data we collect and your choices, please click here.
Personal data collected from other sources:
Avalara may also collect personal data from other sources, including third parties from whom we have purchased data, and we may combine this data with data we already have about you. We may collect personal data from:
Affiliates. We are able to offer you the products and services we make available because of the hard work of our team members across all Avalara entities. To provide our products and facilitate our services, Avalara entities receive personal data from other Avalara entities for purposes and uses that are consistent with this Privacy Notice.
Partners. Avalara may engage in joint marketing activities or event sponsorships with our third-party partners and we may collect personal data about you from these activities. We also allow partners to provide referrals to Avalara of individuals who may be interested in learning more about Avalara’s Services. We rely on our partners to obtain your permission before sharing your personal data with us.
Social Media. When you interact with our services through other social media networks, such as when you follow us or share our content on other social networks, we may receive some information that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include profile information, profile picture, username, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information primarily to operate, maintain, and provide to you the features and functionality of our products and services, as well as to communicate directly with you, such as to send you messages about features that may be of interest to you.
Service Providers. Avalara may also engage with third party service providers who help us understand how our customers are using Avalara’s Services.
Other Sources. We may also collect personal data about you from other sources, including publicly available sources, third-party data providers, brand partnerships, or through transactions such as mergers and acquisitions.
Inferences. We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
How We Use Your Personal Data
Avalara may use the personal data described above for the following purposes:
To operate our Services, provide you with the Service that you or your company has requested, and to continually improve our Service offerings, internal systems, website, and processes.
To manage our organization and its day-to-day operations.
To create and maintain accounts for users and to authenticate your ability to access and use the Services.
To detect and prevent fraud, protect the security of our website and Services, and enhance the safety of our Services.
To troubleshoot or provide customer support.
To communicate with you, including via email, chat, and social media.
To facilitate the relationship we have with you and, where applicable, the company you represent.
To plan and host corporate events, including online webinars.
To provide you with the material you requested, to follow up with you about your interest in the Services, or to register you for the event you request.
To infer additional information about you from your use of our products and services to understand you and your preferences so that we may enhance your experience and send you information about Avalara, our affiliates, and our partners, such as information about promotions or events.
To create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Notice.
To market our products and services to you, including through email and social media.
To help maintain and enhance the safety, security, and integrity of our property, products, services, technology, assets, and business.
To defend, protect, or enforce our rights or applicable contracts and agreements (including our Terms of Use), as well as to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of third parties.
To detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Avalara and others.
To facilitate business transactions and reorganizations impacting the structure of our business.
To comply with contractual and legal obligations and requirements.
To fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.
Avalara may also receive personal data from other sources, including third parties from whom we have purchased data, and combine this with the data we already have about you. This helps us to update, expand and analyze our records, identify new customers, and create more tailored advertising to provide products and services that may be of interest to you.
Our Disclosure of Personal Data
We may disclose or otherwise make available personal data in the following ways:
Service Providers. Avalara may share your data with our contracted service providers and vendors so that these service providers and vendors can perform services on our behalf. For example, we use a third-party customer relationship management platform or data analytics platform to organize data and better understand our customers and prospective customers. These service providers are authorized to use your data only as necessary to provide the requested services to us.
Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our services, on other websites and services, and across other devices. These parties may collect information automatically from your browser or device when you visit our websites and other services through the use of cookies and related technologies. This information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research.
Affiliates and Subsidiaries. We may share your data with our subsidiaries and affiliates (those entities under common control) to provide the Services you request, such as customer support, marketing, technical operations, and account management purposes.
Avalara Partners. Avalara’s extensive partner network provides a broad range of integrations that enable our Services to interconnect with third party software. We may share your data with these partners to support our mutual customers. We may also share your data with our partners who co-sponsor events that you choose to attend.
Vista. Avalara may share personal data with its private equity sponsor, Vista, and its affiliates, including Vista Consulting Group (US), for administration, research, database development, workforce analytics, and business operation purposes.
Payment Processor. Avalara uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on our behalf.
In Connection with a Business Transaction or Reorganization. We may take part in or be involved with a business transaction or reorganization, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in such a business transaction or reorganization. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal data may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets.
To Facilitate Legal Obligations and Rights. Avalara reserves the right to share your data if required by law or to comply with a judicial proceeding, court order, or valid legal process. We may also disclose your data to protect the rights and property of Avalara, our agents, employees, partners and customers, including to prevent or stop an attack on our systems or network or to prevent spam or attempts to defraud our users. Finally, we may also need to disclose your data in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving the sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.
With Your Consent and Direction. We may disclose your personal data to certain other third parties or publicly with your consent or direction. For example, with your permission, we may post your testimonial on our websites.
How to Manage Your Personal Data
Communication Preferences
If you have received promotional communications from Avalara via email and would like to opt-out of future communications, you can click on the “unsubscribe” link located on the bottom of the emails message or you can go here. If you unsubscribe from receiving promotional communications, you may still receive transactional messages regarding Service notifications, updates to our terms or Privacy Notice, or our ongoing relationship. To opt out of other forms of communication, you may unsubscribe by contacting us using the information in the “Contacting Us" section below.
Managing personal data
Avalara provides different accounts with varying functionality depending on the Services users access. Avalara accounts generally permit you to update your user settings or profile by logging into the applicable website or Service with your username and password. If you do not have an account but wish to make a request to manage your data, you can contact Avalara using the information in the “Contact Us” section below.
Requests to manage your data will be addressed within a reasonable timeframe. If you are an employee of an Avalara customer, you may also wish to contact your company’s system administrator for assistance in managing your data.
Automatic Data Collection Preferences
Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where a Avalara-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
Digital Advertising Alliance: The allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.aboutads.info/?c=2⟨=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
European Interactive Digital Advertising Alliance: The European Interactive Digital Advertising Alliance similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.youronlinechoices.eu to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the European Interactive Digital Advertising Alliance’s program.
Network Advertising Initiative: The similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://www.optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal data, or automatically impose limitations on the way we can use personal data in connection with the services they provide:
Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as you mobile device or social media provider), may provide you additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our products and services from accessing certain types of information from your device (such as your contact lists or precise geolocation data), and many social media platforms allow you to change your platform permissions to prevent integrated products and services from accessing certain types of information connected with your profile. Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Google Analytics: Google Analytics allows us to better understand how our customers interact with our services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/.
Children’s Personal Data
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of [13], we will promptly delete that personal data.
International Transfers of Personal Data
Avalara may process and store your data in your region or we may transfer it to the United States or to other countries in which we have affiliates, subsidiaries, or service providers. You can find a list of our global offices here. We may transfer data from the European Economic Area and Switzerland to other countries and, when we do, we use legal mechanisms like contracts to make sure there is an adequate transfer mechanism in place.
Data Controller
Avalara is the data controller for some of the personal data described in this Privacy Notice and is located at 512 S Mangum St #100, Durham, NC 27701. Our telephone number is 1-877-814-9390. If you use Avalara’s Services through your company or organization, then Avalara may be the data processor with respect to your data and your company or organization may be the data controller.
Monitoring of Incoming Emails
All incoming emails sent to Avalara email accounts will be archived and may be scanned by Avalara and/or our external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Third-Party Websites and Services
Our services may include links to third-party websites, plug-ins, applications and other services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices.
Region-Specific Disclosures
We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:
California: If you are a resident of California, please click here for additional California-specific privacy disclosures, including a description of the personal data rights made available to residents of certain states under applicable law.
Changes to this Privacy Notice
Avalara reserves the right to change this Privacy Notice. When we make changes to the Privacy Notice, we will update this page and change the "last updated" date above.
Contact Us
If you have any questions or complaints about this Privacy Notice, please email us at dataprivacy@avalara.com.