Snapshot 7333
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Notice
Effective Date:August 27, 2026
Anaconda Privacy Policy
Anaconda, Inc. and its Affiliates (collectively, “Anaconda”, “we”, “our” or “us”) offer a variety of products, services, and websites (collectively, “Services”). We respect your privacy, and this Privacy Policy describes our practices with respect to Personal Information we collect from or about you when you use our Services.
The terms "Personal Data" and "Personal Information" are used synonymously throughout this Privacy Policy to describe the information that alone or in combination with other information in our possession could be used to identify you, either directly or indirectly. Personal Information does not include aggregated, de-identified, and/ or anonymized information, i.e., when the information has been transformed so that it no longer relates back to a person’s identity.
Please note when we provide our Services under a Master Subscription Agreement with an organization, that organization has control over the information processed by the Services. This Privacy Policy does not apply when we process Personal Data as a service provider or processor for an organization, in such cases, our Data Processing Addendum will apply. For the purposes of this Privacy Policy, a “User” represents an individual user who actively interacts with the Services.
We have made it a priority to gather only the information that is necessary to provide you with the best possible experience while using our Services. We don't share your information with third parties unless it is strictly necessary to deliver the Service you requested, or we are legally obligated to do so. We utilize industry-standard security measures to protect your data from unauthorized access, use, or disclosure.
This Privacy Policy Covers:
Personal Information We Collect
Why and How We Collect, Process, Store and Retain Personal Data
How We Share Personal Information
Third Parties with Whom We Share Personal Data
Cookies and Tracking Technologies
Google Analytics
Your Rights and Choices Concerning your Personal Data
For Users in Europe, EEA or the United Kingdom
For California Residents
For Canadian Citizens
Privacy Center
How We Keep your Personal Data Secure
International Transfer: What You Need to Know
Transfer from the European Economic Area (EEA) and the UK to Third Countries
What You Need to Know about Minors and Personal Data
Disclaimer
1. PERSONAL INFORMATION WE COLLECT
Depending on the nature of your relationship with Anaconda, we may collect various types of Personal Information. We have listed these categories below, to simplify and streamline the process of identifying the categories of Personal Data that we, and our Sub-Processors, collect and process.
Categories of Data Subjects:
Attendees: Those who visit our offices or provide their information to Anaconda or Anaconda representatives when they attend or register to attend Anaconda-sponsored events or other events at which Anaconda (and/or its representatives) participates, as well as those who participate in Anaconda’s studies such as user experience research.
Website Visitors: Those who visit our Websites, including those who may opt to provide an email address or other contact information to receive communications from Anaconda, fill out a survey, or provide feedback. For the purposes of this Privacy Policy, “Websites” refer collectively to www.anaconda.com as well as any other websites Anaconda operates for its own behalf and that link to this Privacy Policy. For clarity, “Websites” does not include any sites owned or operated by our Customers, including where we serve as Registrar.
Customers: Individuals or entities who enter into a subscription agreement with Anaconda (or its authorized partner) and to whom Anaconda provides Services pursuant to such agreement. For purposes of this Privacy Policy, “Services” shall refer to all of the cloud-based solutions offered, marketed, or sold by Anaconda or its authorized partners that are designed to increase the performance, security, and availability of data science packages, applications, devices, and services, along with any software, software development kits, and application programming interfaces ("APIs") made available in connection with the foregoing.
Administrative Users: Those with login credentials for an Anaconda account and/or those who administer any of the Services for a Customer. In some cases, an Administrative User and Customer may be the same individual. In other cases, an Administrative User may be an agent acting on behalf of a Customer.
Public Users: Those who use Anaconda’s public repository at Anaconda.org.
End Users: Those who (i) access or use our Customers’ domains, networks, websites, application programming interfaces, and applications, or (ii) Customers’ employees, agents, or contractors, who access or use Services, such as Anaconda Distribution end users.
Information We Collect:
Data Categories
Personal Information
Employee/ User/ Customer ‘Personal Identifiers’ refers to the basic information that can be used to identify a person.
The First and last name of an individual and the individual's email address are used for communication
If you are applying to one of the positions in our job portal, we might collect date of birth, gender, government-issued identification information, passport or visa information, and legal work eligibility status.
‘Employee/ User/ Customer Credentials’ refers to information used to authenticate a user’s account
User name, passwords, profile picture, and tokens
‘Payment Information’ refers to financial information voluntarily submitted by Users or Customers to purchase Anaconda Products and Services
- Billing address, such as the address associated with the individual's payment method
- Records of past payments and purchases
- Company Size and number of employees
We do not collect credit/debit card information, such as card number, expiration date, security code (CVV), or bank account details, such as bank name, account number, and/or routing number
‘Business Information’ refers to personal information related to an individual’s professional activity and the Organization he/she is related to
The individual's role or title within a company or organization, employer name, business contact information such as work email address, corporate phone number, and physical address
‘Employment Information’ refers to personal information related to an individual's employment
Job title, department, and compensation, benefits information, such as enrollment in health insurance or retirement plans. HR-related information, such as performance reviews, educational history, employment, and military history, former disciplinary actions, and training records. Information related to payroll and taxes, such as Social Security numbers, tax withholding information, tax category
‘Usage, and Metadata’ refers to Information related to how a product or service is used. It might contain or not personal information
Activity logs such as records of actions taken by the individual within a service or platform, session duration, the specific times and dates the individual accessed a service or platform. Information on how the individual interacts with a service or platform, such as clicks, and page views.
‘Device Information’ refers to information related to an individual’s technical gadget, such as a phone or computer
The specific web browser used by the individual, the type of operating system used by the individual, IP address, MAC address, geo-location
‘User-Generated Data’ refers to information created by users in Anaconda Forums and Platform
- Text-based communications, such as chat messages, comments on forums, or direct messages on a social media platform
- Reviews and ratings, such as Feedback provided by individuals regarding products, services, or experiences.
- Blog posts and articles
- Photos and images shared or uploaded, including profile pictures, personal photos, or images used in articles and posts.
- Video content created and shared, such as vlogs, tutorials, or personal recordings.
-Audio content uploaded or shared by individuals, voice messages, or audio clips, video recording
- Customizations and settings, such as the changes made by individuals to personalize their experience on a platform or service, including notification settings
- Timestamps with date and time when content was created or shared by an individual.
- File metadata such as format, size, or resolution
‘Information from Third-party Sources’ refers to any data related to an individual that is obtained from sources other than the individual themselves and that is collected by Anaconda indirectly via public or social platforms
- Data obtained from an individual's social media profiles, such as Likes, Shares, Reactions, Followers, and connections, the use of specific keywords or tags in social media content, or mentioning other users
- Public directories, such as information available through public sources, such as phone directories or online databases.
- Data obtained from third-party sources, such as credit reporting agencies, marketing databases, or government records
Anaconda offers a variety of products and services, some of which are accessed via our website. When you access our website or services, as a User or Customer, we collect, process, and at times, store different data categories such as, Personal Identifiers, User Credentials, Business Information, Device Information, Usage, and Metadata.
When you apply for a position in our Job Portal and start working with us, in connection with human resources functions and activities, we may collect, process, and at times, store different data categories such as, Personal Identifiers, Employment Information and Information from third-party sources.
There are other situations when we collect, process, and store your personal data, such as when you are a potential lead or prospective candidate, when you collaborate in our blogs and forums, when you connect and interact with us through social media profiles, when you receive our communications because you are subscribed to our newsletter or when you sign up for one of our webinars.
Please note we adhere to the Data Minimization principle; therefore, we will only collect or process those data categories that are necessary and relevant for the legal basis for which they are being collected. We do not intentionally collect sensitive personal information from our users, however, in the event that sensitive personal information is inadvertently collected, we urge you to notify us promptly by reaching out to our dedicated privacy email at privacy@anaconda.com and requesting data deletion of your sensitive personal information.
2. WHY AND HOW WE COLLECT AND PROCESS, STORE AND RETAIN YOUR PERSONAL DATA
2.1 Why and How We Collect and Process Your Personal Data
We collect and process your personal data when you have given consent to this processing for one or more specific purposes; and when the processing of personal data is necessary for the purposes of Anaconda legitimate interests such as:
To provide our Services: We collect and process your personal data to provide you with the products and services you request. We use your contact information to provide product support services you might require, to deliver necessary product updates and patches, and to administer user accounts. We may also need to process your personal data for billing purposes or to simply implement, finalize, or enforce a Service or Software Agreement with you.
To personalize your experience: We may collect data to personalize your experience while using our software, such as your preferences and settings.
To improve our Services: We may collect data to understand how our software is used and to identify areas for improvement.
To send you communications: We may use your data to send you communications, such as updates on our software, promotional offers, or other related information, only if you have provided your consent. Also, we collect data when you sign up online for any of our events or training sessions.
For research and development: We may collect data to conduct research and development to improve our software and services. This may include collecting data on how you use our software and your preferences using surveys, questionnaires, interviews, and any other research tool available to us.
For analytics: We may collect data to analyze usage patterns, measure engagement, and track performance metrics. This helps us understand how our software is used, identify areas for improvement, and optimize the user experience.
To provide Customer Support: We may collect data to provide customer support and troubleshoot any issues you might have with our software. This may include your contact information and details about your use of our software.
For administrative purposes: We may use data for administrative purposes, such as to verify your identity, manage your account, or process payments.
For security purposes: We may use data to protect the security of our software and services, including to detect and prevent cyber-attacks, unauthorized access, and other security breaches.
For compliance with legal and regulatory requirements: We may use data to comply with legal and regulatory requirements, such as to respond to government or law enforcement requests, to comply with court orders, or with other legal and regulatory requirements.
Employee Personal Data: Anaconda collects or has access to personal data about employees to carry out and support human resources functions and activities, which may include: (i) recruiting and hiring job applicants; (ii) managing employee communications and relations; (iii) providing compensation and benefits; (iv) administering payroll; (v) processing corporate expenses and reimbursements; (vi) managing employee participation in human resources plans and programs; (vii) carrying out obligations under employment contracts; (viii) managing employee performance; (ix) conducting training and talent development; (x) facilitating employee relocation and international assignments; (xi) managing employee headcount and office allocation; (xii) managing employee termination process; (xiii) managing information technology and communication systems, such as corporate email system; (xiv) conducting ethics and disciplinary investigations; (xv) administering employee grievances and claims; (xvi) managing audit and compliance matters; (xvii) complying with applicable legal obligations, including government reporting and specific local law requirements; and (xviii) other general human resources purposes. Anaconda may also obtain and process personal data about employees’ emergency contacts, and other individuals (such as spouses, family members, dependents, and beneficiaries) to the extent employees provide such information to Anaconda. Anaconda processes this information to comply with its legal obligations and for benefits administration and other internal administrative purposes.
2.2 How we Store and Retain your Personal Data
In accordance with applicable data protection laws and regulations, we may store Personal Data or Information in combination with non-personal information. In such cases, we consider the resulting combination as personal information and will handle it in accordance with our Privacy Policy and applicable data protection laws and regulations.
Additionally, we may remove all personal information from a set of data (anonymization), at which point the remaining information will be considered non-personal information. This means that the information will not be able to identify an individual, and is therefore not subject to the same legal requirements as personal information.
For the storage of personal data, we have a robust infrastructure integrated with Snowflake's cloud-based data warehousing solution with AWS's cloud services. This integration allows us to use the maximum of capabilities to provide security, scalability, and reliability to our customers, either when they are using our Cloud Services, or when we are storing their data in our warehouse. This infrastructure is accompanied by strict Technical and Organizational measures explained in our Information Security Addendum.
Nonetheless, we want to make it clear that our servers and databases are located in the United States, and we do not offer or provide storage options in data centers located in other territories. Therefore, by using our services, you agree and acknowledge that your personal information may be transferred and stored in the United States, which may have different data protection laws than the country in which you reside.
Once stored, we retain the minimum amount of Personal Data necessary for the above-mentioned purposes, and will not use or disclose it for any other purpose without your consent. We will retain your personal data only for so long as a legitimate business or human resources purpose exists or until you have requested us to delete your personal data via our Privacy Center.
We might delete the personal data of Customer, whenever the following conditions are met:
the data subject has submitted a Data Deletion Request or has invoked his right to be forgotten. When you make a data deletion request, to inform Third-Party Sub-processors about the request, we follow these steps:
We verify the request making sure it is valid, by carrying out an ID Verification Process to ensure you are authorized to ask for the deletion of personal data.
We locate data, Identifying the data that needs to be deleted and locate it within your systems and those of the Sub-processors.
We notify Sub-processors by sending a notice to all relevant Sub-processors of the data deletion request and providing them with the necessary information to locate and delete the data in a maximum period of ninety (90) days.
We monitor compliance, making sure the Sub-processors are compliant with the data deletion request in the appointed period of time.
We Confirm deletion, guaranteeing that the Sub-processors deleted the data and providing evidence of the deletion to the user if necessary.
We update records to reflect the deletion of the data, and we document the steps taken to comply with the request.
It is no longer necessary for the fulfillment of the Anaconda's legal basis. In this case, in compliance with the principles of storage limitation and data minimization, we regularly carry out a Periodic Data Deletion Process to clean our database of the personal information we no longer need, especially of those Customers or Users who have become inactive or who haven’t interacted for a period of twenty-four (24) months with Anaconda products and Services.
Anaconda has detected a security threat that can put at risk the Company's systems or the Anaconda user community. In such cases, Anaconda shall take the necessary measures to delete the personal data of the data subject in a timely and secure manner, ensuring that the data is properly disposed of and cannot be accessed or used by unauthorized third parties.
3. HOW WE SHARE YOUR PERSONAL DATA
3.1 Categories of Third-Parties with Whom We Share Personal Data
In this Section, we outline the circumstances under which we may share personal data with various entities:
Third-Party Sub-processors: Anaconda may engage and contract with these third-party companies to provide services that help us with our business and human resource activities, such as software support services, contract management services, sales support services, software training services, benefits administration, human resource compliance, and management platform, employee stock options management platform, and in-office communications system. These third-party service providers are limited to only using the information as instructed to provide contracted services to us.
Some of these Third Parties we share personal data with are Sub-processors. These processors assist us in providing our main services, such as hosting providers or payment processors. We carefully vet our Sub-processors to ensure that they maintain appropriate data protection and security measures, and we enter into binding agreements with them that require them to process personal data in accordance with our instructions and to maintain the confidentiality and security of the personal data they receive.
Partners: We may also share personal data with Partners for the purpose of providing our services or to further our legitimate business interests. For example, we may share personal data with a marketing Partner to help us promote our services. Third-party Partners are required to comply with strict data protection requirements and are prohibited from using the information for any purpose other than as instructed by us.
Affiliated Businesses: In certain circumstances, we may be associated with businesses or third parties that offer or provide goods or services to users through or in association with our Services, either alone or in conjunction with us. You can identify when an affiliated business is connected with such a transaction or service. We will only share your Personal Information with the affiliated business to the extent that it is necessary for the transaction or service. We do not have authority over the policies and practices of third-party software or businesses, including their privacy policies. Therefore, if you opt to participate in any transaction or service that is associated with an Affiliated Business, we advise you to review all policies of such businesses or websites carefully.
Intercompany Transfers: Pursuant to this Privacy Policy, we may disclose or transfer any information we collect to a third party in the event of a merger, sale of company assets, financing, or acquisition of all or a portion of our business. In these situations, personal data may be transferred to the new controlling entity as part of the transferred business assets. The new controlling entity will be required to comply with our privacy commitments and to use the personal data in accordance with this Privacy Policy. In such instances, we will make reasonable efforts to notify affected individuals through email or a conspicuous notice of the Services and the transaction made, as well as the options you have on your personal data.
For Legal Reasons: Anaconda may also disclose your personal data as required by law, such as to comply with a subpoena or similar legal processes. To the extent we are legally permitted to do so, we will take commercially reasonable steps to notify you in the event that we are required to provide your Personal Data to third parties as part of a legal process. Anaconda may also be required to disclose personal data in response to lawful requests by public or law enforcement authorities.
3.2 Use of Cookies and Tracking Technologies
Anaconda uses various types of cookies on its website and applications, including essential functionality cookies, performance and analytics cookies, targeting or advertising cookies, and social media cookies. Cookies are small text files that are placed on your device by websites and applications that you visit. They are used to collect and store information such as login credentials, user preferences, and website analytics data. By using Anaconda's website and applications, you consent to the use of cookies in accordance with this Cookies Clause and the Cookies Consent Notice visible when you enter any Anaconda’s website.
Essential functionality cookies are necessary for the proper functioning of Anaconda's website and applications, and cannot be disabled.
Performance and analytics cookies gather data on website usage to improve Anaconda's services.
Targeting or advertising cookies are used to track your online activity and show you personalized advertisements. Social media cookies are used for integration with social media platforms.
Sale or sharing of Personal Information
Anaconda may use both session cookies (which expire once you close your web browser) and persistent cookies (which remain on your device until they expire or are deleted). Anaconda may also use Third-Party Cookies, which are placed by a third party separate from Anaconda, for various purposes, including website advertising and social media integration.
You may have the option to disable Performance and Analytics, Targeting or Advertising, and Sell or Share cookies through your web browser settings or opt-out through our Privacy Center.
3.3 Google Analytics
We utilize various features provided by Google Analytics (GA) (User-ID tracking, Demographics and interests reports, Remarketing, and AdWords integration) to measure the performance and success of our products, marketing campaigns, courses, and initiatives. These features may include tracking the number of visitors to our website, analyzing user behavior on our website, and identifying which pages and features are most popular with our users.
However, we recognize that the collection and processing of personal information are subject to strict legal requirements under data protection laws and regulations, including the General Data Protection Regulation (GDPR) in the European Union. As such, we do not share Personal Information with GA that originates from Austria, Denmark, Finland, France, Italy, and Norway, in accordance with recent national rulings related to data protection.
Furthermore, we apply technical measures to exclude any kind of GA-related tracking on our website in prohibited territories in order to ensure the safety and security of our Users' Personal Information. These measures may include, but are not limited to, blocking GA cookies and IP addresses from being transmitted to GA servers and implementing opt-out mechanisms that allow users to choose whether or not their personal information is collected and processed by GA.
3.4 Prospective Customers.
To protect our intellectual property and to enforce our Terms of Service, we may share personal data (e.g., name, email, IP) with our prospective Customers strictly for the purpose of identifying, confirming, and remediating unauthorized use of our Services.
3.5 Artificial Intelligence and Other Integrations
By accessing or using our advanced products and services, including our innovative artificial intelligence offerings like Anaconda Assistant, you expressly consent to the collection, use, and disclosure of your personal information as described in this section. Specifically, we may share your personal information, including but not limited to, usage data and messages, with third-party service providers and partners such as OpenAI for the purpose of enhancing functionalities, improving user experience, and developing new features. Additionally, for users who engage with our Anaconda Toolbox embedded within Microsoft Excel, please be advised that your personal information may be collected, stored, and processed not only in accordance with this Privacy Policy but also under the terms and conditions set forth by Microsoft’s Privacy Policy. Any cross-border transfer, storage, and utilization of your personal information shall be carried out in strict compliance with applicable data protection and privacy laws, including the General Data Protection Regulation (GDPR) where applicable. Your information may be subject to the legal jurisdiction of the countries in which our service providers operate. It is your responsibility to review and understand the privacy policies of these third parties and your continued use of Anaconda Assistant or Anaconda Toolbox constitutes your acknowledgment and agreement to be bound by these multi-jurisdictional data practices.
4. WHAT RIGHTS AND CHOICES DO YOU HAVE CONCERNING THE PERSONAL DATA WE COLLECT
4.1 If you are in Europe, EEA or the United Kingdom
As a data subject, you have certain rights with respect to the personal information that we collect and process. These rights include:
Right of Access (Art. 15 GDPR). You have the right to request a copy of the personal information we hold about you and to know how that information is used. In accordance with this right, our organization will provide you with a copy of your personal data upon request, free of charge. You can request access to your personal data by request in our Privacy Center. It is important to note that in some cases, we may not be able to provide you with access to your personal data if it interferes with the rights and freedoms of others or if it is protected by legal privilege.
Right to Rectification (Art. 16 GDPR). You have the right to request that we correct any inaccuracies in the personal information we hold about you. In accordance with this right, our organization allows individuals to request the correction of their personal data if they believe it to be incorrect or outdated. If we have disclosed incorrect information to third parties, we will take reasonable steps to inform them of the correction where appropriate.
Right to Erasure (Art. 17 GDPR). You have the right to request that we delete your personal information in certain circumstances. In accordance with this right, our organization will erase your personal data upon request, provided that there are no overriding legitimate grounds for retaining it. It is important to note that in some cases, we may not be able to fulfill your request for erasure if your personal data is required for legal reasons or to perform our contractual obligations.
Right to Restrict Processing (Art. 18 GDPR). You have the right to request that we restrict the processing of your personal information in certain circumstances. In accordance with this right, our organization will restrict the processing of your personal data upon request, provided that there are no overriding legitimate grounds for continuing the processing. This means that we will only store your personal data and not use it for any other purposes, unless you give us your consent.
Right to Object (Art. 21 GDPR). You have the right to object to the processing of your personal information in certain circumstances, including for the purpose of direct marketing or profiling. In accordance with this right, our organization will stop processing your personal data upon request, provided that there are no compelling legitimate grounds for continuing the processing.
Right to Lodge a Complaint (Art. 77 GDPR). You have the right to lodge a complaint with the relevant supervisory authority if you believe we have violated your rights. We encourage all Customers and Users to bring any concerns to our attention by contacting our Data Protection Officer (privacy@anaconda.com). If you are not satisfied with our response, you have the right to file the complaint with the relevant Supervisory Authority.
The European Supervisory Authority responsible for Anacond, Inc., is the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin, Germany, Phone: +49 (0) 30 13889-0, Fax: +49 (0) 30 2155050, Email: mailbox@datenschutz-berlin.de
Overall, you have the right to be informed on the use of your personal data, and you have the choice to request that we do not continue to process or store your data for some reason. To review and update your personal data to ensure it is accurate or request we delete or return your data to you, please contact Anaconda’s Privacy Compliance Team and see how to use our Privacy Center below (Section 4.5).
4.2 If You Are a California Citizen
As a user, you have certain rights under the California Privacy Rights Act (CPRA) (CA CIV code 1798.100 C) concerning your personal information. These rights include:
Right to delete Personal Information: You have the right to request that we delete any personal information collected about you. If we receive such request, we will not only delete your personal information from our records but also notify and demand to our service providers, contractors, and third parties to whom we have sold or shared your personal information to delete your information unless it is impossible or involves a disproportionate effort. We may maintain certain personal information despite your request for a number of stated legal purposes.
Right to Correct Inaccurate Personal Information: You have the right to request that we correct any inaccurate personal information that we maintain about you.
Right to Know What Personal Information has been Collected: You have the right to request that we disclose to you the categories of personal information we have collected about you, the sources from which we collect the personal information, the business purpose for collecting, selling or sharing your personal information, the categories of third parties to whom we disclose your personal information, and the specific pieces of personal information we collected about you.
Right to Opt-Out of Sale of Personal Information: You have the right to opt out of the sale of your personal information to third parties.
Right to Limit Use and Disclosure of Sensitive Personal Information: We do not collect sensitive personal information from users, but if you believe or confirm that we have collected or processed your sensitive personal information, you can exercise your right by submitting a request in our Privacy Center (https://legal.anaconda.com/about)
Non-Retaliation: We will not discriminate against you because you exercised any of your rights under the CPRA.
Do not Share o Sell Information Clause. We do not sell or share your personal information with third parties for monetary or other valuable consideration, but your information might be shared to provide you with our services (See Sections 3.1 and 3.2).
Opt-in. As part of your privacy choices, when you enter our webpage, you can use our Consent Manager displayed at the bottom page to decide if you want to opt-in to the use of cookies that might involve sharing your personal information.
Opt-out:IIf you have already opted in, you can always opt out of the sharing or sale of your personal information to third parties by modifying your browser privacy and security settings through the link chrome://settings/ or submitting a request in our Privacy Center (https://legal.anaconda.com/about/en/)
If you opt out in compliance with the CPRA, we commit not to ask for consent to share your information until at least twelve (12) months after the initial opt-out.
In case you are a minor under the age of 16, we will not sell or share your personal information without your affirmative consent or the affirmative consent of your parents or guardian if you are under the age of 13.
Pre-Action Notice-and-Cure Requirement
If you believe that we have violated your rights under the CPRA, you may have the right to bring legal action against us. Before doing so, you must provide us with 30 days' written notice identifying the specific provisions of the CPRA that you allege we have violated. If we cure the noticed violation within the 30-day period and provide you with an express written statement that the violations have been cured and that no further violations shall occur, you may not initiate any legal action.
However, if we continue to violate the CPRA after providing you with an express written statement, you may bring an action against us to enforce the statement and pursue statutory damages for each breach of the statement, as well as any other violation of the CPRA that postdates said statement.
The Californian Competent Authority is the California Privacy Protection Agency, 2101 Arena Blvd, Sacramento, CA 95834. Phone: +1 (279) 895-1412, Email: info@cppa.ca.gov
4.3 If you are a Canadian Citizen
We comply with the Canadian Consumer Privacy Protection Act (Bill C-27) amending the Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Information and Data Protection Tribunal Act (PIDPT). If you are Canadian Citizen, we guarantee that we collect personal information on a lawful basis, and we share it under the provision of the Data Mobility Framework with other organizations that provide the required security standards, requirements for format, and transfer mechanism.
When we process your data we do not use automated decision-making. In case we do, you will be informed, and we will comply with the Algorithmic Transparency Principle, informing you (without risking our intellectual property) how we implement said tools.
Once we process your personal information, you will have the right to know what personal information is being collected, used, or disclosed. Also, you will have the option to withdraw consent, the right to be forgotten, and the right to data portability. In alignment with the Bill, we have created a Privacy Management Program that includes the policies, practices, and procedures to facilitate the way your exercise your rights. (See Sections 4.5 and 5)
4.5 Use our Privacy Center
This Section is oriented to guide you on how to make a request in our Privacy Center. The "Delete all my data" request will attend to your rights of data erasure, deletion, or the right to be forgotten. The "Do not Contact request" will attend to your rights of Right to Restrict Processing and Right to Object, we will continue to process your information for activities not related to marketing and sales.
The "Download all my data" attends to your rights of Knowing What Personal Information has been Collected from you and your rights of Access and Data Portability. On the other hand, the "Correct my data" request attends to your rights to Correct Inaccurate Personal Information or the right to rectification.
To make a request, simply provide the email associated with your account. We will respond to your request within a maximum timeframe of thirty (30) to sixty (60) days and may need to verify your identity before fulfilling your request. Please note that certain rights may have limitations, and we must comply with the laws of your jurisdiction. Our Privacy Compliance Team will assist you with your request, providing appropriate information and guidance throughout the process to protect your rights.
5. Privacy Center
Our Privacy Center facilitates the exercise of your privacy rights in the U.S. and the E.U. To initiate any requests related to your personal data, you can access the Privacy Center by clicking on the designated link located in the upper right corner of our Legal Page (https://legal.anaconda.com/about/en/). Prior to submitting your request, it is essential to select the appropriate data subject type that corresponds to you and specify the data subject request you wish to address. Upon submission, you will promptly receive a confirmation email acknowledging receipt of your request. Depending on the nature of your request, additional instructions may be included in the confirmation email to guide you through the process effectively. If you have not received an answer thirty (30) days after submitting your request, please contact us at privacy@anaconda.com
6. How we keep your personal data secure
We take data security seriously and have implemented various measures to ensure that Customer Protected Data is safe during transmission. This includes using AES-256 strong encryption for all ingested data and VPNs. Anaconda manages its security infrastructure effectively by utilizing firewalls, routers, IPS/IDS devices, load balancers, and VPN concentrators to control access between the internet and its Cloud Service. Anaconda utilizes containerization and segmentation to control access to networks and private clouds, only allowing authorized traffic.
To maintain the highest level of security when personal data is at rest, Anaconda performs periodic vulnerability assessments on its applications and systems. These assessments include both automated analysis and manual assessments, which will have a unique common vulnerability and exposure identifier associated with a Common Vulnerability Scoring System (CVSS) that will help us to remediate in a timely manner any urgent issue.
To ensure access to personal data, we regularly back up our systems used to provide a Cloud Service to our Customers to ensure that their data is available. These backups are appropriately classified according to our internal data classification definitions and are protected to ensure that only authorized individuals are able to access the Protected Data. This includes but is not limited to data stored off-site in electronic media and the protection of hard copy records.
Finally, to ensure the effectiveness of our Security System, we regularly test and monitor its controls, systems, and network to validate proper implementation and effectiveness in addressing the threats, vulnerabilities, and risks identified. This testing and monitoring include internal risk assessments, formal procedures such as port scans, testing, and validation of multi-factor authentication for select environments, third-party compliance, including hosting services and third-party components, penetration testing, and assessing changes affecting systems processing authentications, authorizations, and security audits.
If you need additional information, you can ask for our Security Information Addendum, by writing to privacy@anaconda.com
7. INTERNATIONAL TRANSFER: WHAT YOU NEED TO KNOW
7.1 Transfer from the European Economic Area (EEA) and the UK to Third Countries
We are headquartered in the United States of America. Personal data may be accessed by us or transferred to us in the United States. If personal information is transferred to Anaconda from the European Union or another transfer or jurisdiction that has determined that the United States does not provide an adequate level of protection, Anaconda will take adequate measures designed to protect the personal information, such as ensuring that such transfers are subject to a Data Processing Agreement and the terms of the EU Model Clauses or other adequate transfer mechanisms as required under relevant data protection laws.
Furthermore, in compliance with the GDPR and UK GDPR, we have performed a Data Protection Impact Assessment to identify and mitigate any potential risks to individuals' rights and freedoms, you can find our Transfer Impact Assessment (TIA) at the end of our Data Processing Agreement.
Additionally, with Customers located in the UK, we sign an International Data Transfer Agreement (IDTA) with its addendum approved in 2022 by the Information Commissioners Office (ICO) in replacement of the European Contractual Clauses.
8. WHAT YOU NEED TO KNOW ABOUT MINORS AND PERSONAL DATA
We are committed to providing a safe and secure environment for students who use our Learning Services. Our Anaconda Learning Platform and other services as EduBlocks are specifically designed to cater to the needs of students and to provide them with an engaging and interactive learning experience. We take the necessary steps to ensure that our services are age-appropriate and do not contain any content that may be harmful to minors.
If you are under 18 years of age, you can rest assured that your personal information is safe with us. We take all necessary measures to ensure that your data is secure and protected. We fully comply with the Children's Online Privacy Protection Act (COPPA) and any similar international, federal, state, or local laws, rules, or regulations aimed at protecting children's privacy, if we collect personal information from children under 13 years of age, we do it so only with the express consent and participation of a parent or legal guardian, and such information is collected for the sole purpose of providing our Learning Services to the child and is never disclosed to any third parties without the parent's or legal guardian's express consent.
9. DISCLAIMER
By agreeing to this Privacy Policy, you explicitly give Anaconda, Inc. permission to process your personal data for the purposes stated above. If you wish to withdraw your consent, you can contact our Privacy Compliance Team through the Privacy Center. By providing us with your personal data, you acknowledge that it may be stored or processed in the United States and subject to US laws, including those allowing government agencies, courts, and law enforcement to access personal data.
LEGAL NOTICE INFORMATION
Anaconda Inc., (formerly Continuum Analytics, Inc.)
FEIN: 45-4029380
Location:
Austin
1108 Lavaca Street Suite 110-645
Austin, TX, 78701, USA
Anaconda Germany GmbH
VAT: DE289537954
Location:
Berlin
Friedrichstrasse 123
10117 Berlin, Germany
ANACONDA TRANSFER IMPACT ASSESSMENT
OVERVIEW
We are a US-based Company that provides a data science platform for developers and data scientists worldwide. Our platform collects and processes personal data from users located in various countries, including the European Union (EU). As a result, Anaconda is subject to various Data Protection and Privacy Laws in these territories, including the binding decision from regional and national courts where Anaconda operates.
In order to provide its services, Anaconda may need to transfer personal data from users located in the EU to servers located in the United States (US). This data transfer may impact the privacy rights and data protection obligations of both Anaconda and its users, and must be assessed for compliance with the GDPR and other applicable Data Protection Laws.
The purpose of this assessment is to ensure alignment with Schrems II Judgment CJEU - C-311/18 and to ensure we are able to transfer personal data from the EU to the US in a manner that is compliant with the GDPR and other applicable Data Protection Regulations, and that respects the privacy rights of its users. By conducting this assessment, we and our Customers can identify any potential risks or issues associated with the transfer and take appropriate steps to mitigate them, thereby reducing the risk of harm to individuals and avoiding potential legal or reputational consequences.
Particularly, the assessment will evaluate the legal, technical, and organizational measures in place to ensure the security and confidentiality of the personal data, as well as any potential risks associated with the transfer. The assessment will also identify any mitigation strategies or actions that may be necessary to ensure compliance with applicable laws.
TRANSFER IMPACT ASSESSMENT
2.1 Details of the Data Transfer
We always enter into a Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) when we process personal data as a processor or sub-processor through our different products and services, such as the Platform, Cloud and Learning Services, Notebook Services, and other services. The SCCs serve as an assurance that Anaconda provides adequate Data Protection Measures when processing the data of data subjects located in Europe. In Annex I of the DPA, we include a thorough description of the transfer and detailed information about the data subjects, the categories of data collected and processed on behalf of a Customer or user, the nature of the processing, the frequency of the transfer, and the period for which the personal data will be retained and processed. Annex I also includes the competent Supervisory Authority in Europe and the UK for any data-related matter. By providing this information, we also ensure transparency and accountability with respect to processing activities.
We collect personal data from the EU and transfer and store personal data in the United States (US) and other countries outside the European Economic Area (EEA) and the United Kingdom (UK). Primarily, we transfer personal data to the US and Canada in addition to the EEA and the UK to its affiliates, which may provide services, such as consulting or support, depending on Customer’s location and Agreement(s) with us.
It is important to note that although the US is not considered by the European Commission to provide an adequate level of data protection., we are committed to ensuring that all data transfers comply with the EU's General Data Protection Regulation (GDPR) and the Standard Contractual Clauses (SCCs). As such, Anaconda has implemented appropriate Technical and Organizational Measures described in Annex II of the DPA and in our Information Security Addendum, to ensure the security and confidentiality of personal data that is transferred and stored outside the EEA and the UK. These measures include data encryption, access controls, and regular security audits to ensure compliance with relevant standards and regulations.
2.2 Transfer Tools Used for the Data Transfer
We understand that the transfer of personal data from the EU to the United States carries certain risks, including:
The risk that the personal data may be subject to access, use, or disclosure by unauthorized persons
The risk that the personal data may be subject to surveillance by government authorities in the United States
The risk that the transfer may not be compliant with the requirements of the GDPR or other applicable privacy laws
To mitigate these risks, we not only implemented mitigation strategies, such as using the new Standard Contractual Clauses (SCCs) (To visualize the complete SCCs, please access our DPA in our Legal Page or via a request to legal@anaconda.com) released by the European Commission released updated EU in June 4, 2021, but we implemented other mitigation strategies related to ensuring the security and confidentiality of the personal data, guaranteeing that only authorized personnel have access to the personal data, monitoring and auditing access to the personal data, as well as, conducting regular assessments of the adequacy of the measures in place and making improvements as necessary the full spectrum of our Security System and the details of our Security Measures can be visualized in the DPA and in the Anaconda Information Security Addendum in our Legal Page.
Regarding the period of processing, Anaconda maintains a comprehensive internal Data Retention and Deletion Policy that is designed to ensure that all data is retained and stored only in accordance with the principles set out in the GDPR. These principles require that personal data is processed lawfully, fairly, and transparently and that it is only retained for as long as necessary for the purposes for which it was collected. In order to comply with these principles, Anaconda takes a number of steps to restrict and limit the storage of Customers personal data in time. For example, Anaconda imposes contractual obligations on all of its third-party service providers and sub-processors to ensure that they also adhere to these principles and requires them to implement similar data retention and deletion policies. Furthermore, Anaconda has implemented robust technical and organizational measures to ensure that Customer personal is securely deleted once it is no longer required. These measures include the implementation of data retention schedules and the use of automated tools and processes to monitor and delete data.
2.3 Effectiveness of the Measures Regarding the Transfer
2.3.1 US. Surveillance Laws
The Court of Justice of the European Union identified the following US laws as potential barriers to ensuring essentially equivalent protection for personal data in the US in the Schrems II case:
FISA 702: refers to Section 702 of the Foreign Intelligence Surveillance Act (FISA), which is a law in the United States that governs surveillance activities by the federal government for the purpose of collecting foreign intelligence information. FISA 702 specifically authorizes the collection of electronic communications of non-US persons located outside the US for foreign intelligence purposes.
The law requires that FISA 702 surveillance must be approved by the Foreign Intelligence Surveillance Court in Washington, DC, which is a secret court that oversees requests for surveillance warrants. The court must find that the government's proposed surveillance activities comply with constitutional and statutory requirements, such as the Fourth Amendment's protection against unreasonable searches and seizures.
European Authorities have raised concerns about FISA 702, particularly with regard to the collection of communications of US persons incidentally collected during foreign intelligence surveillance. Nonetheless, the White Paper Notes published in September 2020 about U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II explains that “Most U.S. companies do not deal in data that is of any interest to U.S. intelligence agencies, and have no grounds to believe they do. They are not engaged in data transfers that present the type of risks to privacy that appear to have concerned the ECJ in Schrems II” and “The government must record in every case the reasons a specific personal data was targeted.” This is the case for Anaconda.
Executive Order 12333. It is a United States Federal Government Order from 1981 that outlines the goals, roles, and responsibilities of various intelligence agencies within the U.S. government. It authorizes intelligence agencies like the National Security Agency (NSA) to conduct surveillance outside of the U.S. and provides authority for U.S. intelligence agencies to collect foreign "signals intelligence" information, which includes information collected from communications and other data passed or accessible by radio, wire, and other electromagnetic means. This may include accessing underwater cables carrying internet data in transit to the US.
The White Paper Notes published in September 2020 about U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II discussed EO 12333 in relation to the Schrems II ruling. The whitepaper notes that EO 12333 does not on its own authorize the U.S. government to require any Company or person to disclose data and instead appears to rely on exploiting vulnerabilities in telecommunications infrastructure. It also states that bulk data collection, the type of data collection at issue in Schrems II, is expressly prohibited under EO 12333.
Overall, the White Paper Notes suggest that EO 12333 does not present a significant obstacle to ensuring essentially equivalent protection for personal data in the US, provided that appropriate safeguards are in place.
CLOUD Act. The Clarifying Lawful Overseas Use of Data Act, commonly known as the CLOUD Act, is a U.S. law enacted in 2018 that governs how U.S. law enforcement agencies can access electronic data stored by U.S. technology companies, even if that data is stored outside the United States.
In the White Paper Notes published in September 2020 on U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II, it is noted that the CLOUD Act only permits U.S. government access to data in criminal investigations after obtaining a warrant approved by an independent court based on probable cause of a specific criminal act. The CLOUD Act does not allow U.S. government access in national security investigations, and it does not permit bulk surveillance.
2.4 Anaconda’s role regarding Surveillance Laws
Anaconda, as a SaaS Company based in the United States, may potentially be subjected to FISA 702 as a Remote Computing Service Provider ("RCSP"). However, we are not engaged in the processing of personal data that is likely to be of interest to US intelligence agencies.
Moreover, we are not expected to be subjected to upstream Surveillance Orders pursuant to FISA 702, which is the type of order primarily addressed in, and deemed problematic by, the Schrems II Decision. We solely carry traffic involving our own Customers and do not provide internet backbone services. The US Government has so far construed and executed FISA 702 upstream orders to solely target market providers that carry traffic for third parties and that have traffic flowing through their internet backbone, such as telecommunications carriers.
Executive Order 12333 does not empower US authorities to compel private companies, including Anaconda, to disclose personal data. FISA 702 necessitates the approval of an independent court to authorize a specific type of foreign intelligence data acquisition, which is generally not associated with commercial information. In the unlikely event that US intelligence agencies were interested in the type of data processed by Anaconda, safeguards such as the requirement for independent court authorization and the necessity and proportionality requirements would safeguard data against excessive surveillance.
2.5 Answers to U.S. Government Access Requests
We recognize the importance of protecting the privacy and security of its Customers' data, as well as complying with applicable laws and regulations., and despite the fact we have not received Government Access Requests (‘Requests’) before, we have established Policies and Procedures for responding these Access Requests in a manner that minimizes the impact on its Customers' privacy while complying with Legal Requirements.
Therefore, for handling Government Access Requests, which includes verifying the request's legality, specificity, and scope, our Legal Team reviews each Request to ensure it is valid and complies with the Law. Additionally, we limit the amount of information disclosed to the minimum necessary to comply with the request. Anaconda also seeks to notify affected Customers as soon as possible, unless prohibited by law, to allow them to exercise their Legal Rights to challenge the Request.
Overall, Anaconda is committed to upholding its Customers' privacy and security while complying with applicable laws and regulations. Our policies and procedures for handling government access requests are designed to ensure compliance while minimizing the impact on its Customers' privacy. Anaconda is also committed to continuously reviewing and updating its policies and procedures to ensure that they reflect evolving legal and regulatory requirements and best practices.
3. Technical and Organizational Measures Used in Transfer
Anaconda has implemented robust Technical and Security measures to protect Customer Protected Data processed by Third Parties. These measures are set out in the Information Security addendum in our Legal Page, which is a comprehensive document detailing Anaconda's approach to Data Security. In particular, Anaconda secures Data in Transmission using a combination of industry-accepted encryption and Virtual Private Networks (VPNs).
Anaconda's Information Technology team and Security Group impose a set of strict controls on accessing or storing Customer Protected Data on mobile devices, tablets, or laptops. Additionally, Anaconda utilizes and manages Security Infrastructure with firewalls, routers, Intrusion Prevention/Detection Systems (IPS/IDS), load balancers, and VPN concentrators to control access between the internet and Cloud Service. These security measures are designed to containerize and segment access by security profiles to controlled networks and private clouds, allowing only authorized traffic to pass through. Anaconda periodically evaluates and reviews its security measures to ensure that they remain effective and aligned with industry best practices.
4. Periodic Reviews and Assessments
Anaconda shall conduct periodic Reviews and Assessments to determine whether the risks associated with Data Privacy Regulations have changed and whether measures implemented to address the risks associated with transferring personal data outside of Europe are adequate. Such evaluations shall be conducted at appropriate intervals, taking into account the risks involved, the scope, nature, and purpose of the processing activities, and any new developments or changes in applicable data protection laws or risk environments. If necessary, we will reconsider and revise our risk management and privacy measures to address any new uprising risk or change in the Data Protection Regulatory Environment.