We at Degreed, Inc. (“Degreed”, “we”, “us” or “our”) are committed to respecting the privacy of our users. We strive to provide a safe, secure online experience. This privacy policy sets forth the online data collection, usage, maintenance, disclosure and protection policies and practices that apply whenever you visit or your personal information is disclosed in connection with the Degreed.com website (together: “Site“) and functionality provided through or in connection with it, such as our Degreed social media channels, emails, events, forms and served ads (“Services“). We are not responsible for the privacy policies or practices of other websites to which links are included on this Site.

This privacy policy does not set forth the online data collection, usage, maintenance, disclosure that apply to users of the Degreed or LearnIn applications. This information is presented in the privacy policies available when accessing the respective applications.

When you visit our Site and use our Services we may receive personal information relating to you. “Personal Information” is information that can directly or indirectly identify you or could reasonably be linked with you or your household, such as your first name, last name, business email address, social media handles, telephone number or payment information (if you register for a paid event that we run).

We may also receive other information relating to you or your device used to access our Site or Services which may also be considered Personal Information, such as your IP address, device type, operating system, browser type, and other technical information.

You can choose not to provide certain data to us, but you may not be able to use certain features of our Services.

• To stop receiving email communications from us, you can opt out by using the unsubscribe mechanism in the footer section of the email you have received. Note that you may still receive transactional messages regarding our Site and Services from us, including administrative confirmations, order confirmations, important updates about our Services, and notices about our policies.
• For Personal Information received through cookies or other similar technologies the browser or device you use may allow you to control cookies and other types of local data storage. Your wireless device may also allow you to control whether location or other data is collected and shared. You can manage the Degreed cookies through the Osano Cookie Consent tool on the bottom-right side of our website. For further information about how you can control Cookies, please see our Cookie Notice.

Degreed retains user data for as long as necessary for the purposes described above. This means that we retain different categories of data for different periods of time depending on the category of user to whom the data relates, the type of data, and the purposes for which we collected the data.

We retain Personal Information data collected through our Site for up to 3 years.

Users may request deletion of their Personal Information at any time by emailing privacy@degreed.com.

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use Personal Information about you. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Notice.

Email Tracking Pixels

Certain marketing emails sent through our email platform contain tracking pixels and tracked links. These allow us to know whether and when an email was opened or a link was clicked, and to collect related technical information, including your IP address (and IP-derived approximate location), device and email client type, and the specific links clicked.

We use this information for the following purposes:

• List and deliverability management: to identify inactive addresses and adjust sending frequency.
• Campaign measurement and personalization: to measure open and click rates, run A/B tests, personalize content, and inform send-time or nurture-sequence decisions.
• Cross-channel profiling: to use your engagement with our emails to inform how we may target or personalize content to you through other channels.
• Data quality and bot filtering: to help identify and exclude non-human (automated) opens from our engagement reporting.

Where required by applicable law, we collect your consent for the use of email tracking pixels through a dedicated, affirmative opt-in presented at the point of data collection (e.g., on our web forms), separate from the entry of your contact details. You may withdraw your consent at any time by managing your preferences through the link provided in our emails, or by contacting privacy@degreed.com.

Engagement data associated with tracking pixels is currently retained for the duration of our relationship with you as a contact in our systems. For more information about how long we retain your Personal Information generally, see “How Long Is Your Information Retained?” above.

When you submit information to Degreed, we do our utmost to ensure that information is protected against loss, misuse, alteration, destruction or unauthorized access. Degreed implements technical and organizational measures to protect information, which include appropriate privacy and security policies, training and awareness initiatives, strong access control, up-to-date anti-virus software and industry standard authentication methods for accessing the data. Degreed also uses standard encryption tools such as SSL (Secure Socket Layer) to help protect Personal Information and to keep information collected secure.

Our Site and Services are intended for adult professionals. Our Site and Services and materials featured on them are not intended for, and we do not intend to collect information from, children under the age of 18. If we learn we have collected or received Personal Information from a child under the age of 18, we will delete that information. If you believe we might have any information from or about a child under the age of 18, please contact us at privacy@degreed.com.

For users located in the European Economic Area, Switzerland or the United Kingdom (collectively, “European Users“), If a European User accesses or uses our Site or Services, Degreed is the “data controller” of their Personal Information and we perform any processing of your Personal Information in accordance with this privacy policy

European Users have data protection rights. These rights include:

• Right of access: The right to obtain access to your Personal Information.
• Right to rectification: The right to correct or update inaccurate or incomplete Personal Information.
• Right to erasure: The right to obtain the erasure of your Personal Information in certain circumstances.
• Right to portability: The right to move, copy, or transfer your Personal Information.
• Right to restrict processing: The right to restrict processing of your Personal Information.
• Right to object to processing: The right to object to processing of your Personal Information for certain purposes.
• Right to withdraw consent: The right to withdraw your consent to the processing of your Personal Information where we have relied upon your consent to do so.
• Right related to automated decision-making: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in limited circumstances permitted by law.

To exercise any of the rights outlined above, please contact us at privacy@degreed.com.

Please be advised, we may need to request specific information from you to confirm your identity before processing your request.

If we are unable to satisfactorily resolve your request you have the right to lodge a complaint with a supervisory authority. If you are in the European Economic Area you may contact your local data protection authority. You can find details for your local data protection authority by visiting https://edpb.europa.eu/about-edpb/board/members_en, telephoning +32 2 299 11 11, or writing to Directorate-General for Justice and Consumers | European Commission at 1049 Bruxelles/Brussel, Belgium.

If you are in the United Kingdom you may contact the Information Commissioner’s Office by visiting https://ico.org.uk/global/contact-us/, telephoning +44 (0) 303 123 1113 or writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Notice to Users in Switzerland

If you are located in Switzerland, Degreed processes your Personal Information in accordance with the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance.

Swiss residents have the following rights:

• Right to information: the right to request confirmation of whether we process Personal Information concerning you, and to obtain information about that processing, including its purpose, the categories of data processed, and the recipients or categories of recipients to whom it is disclosed.
• Right to rectification: the right to request correction of inaccurate Personal Information.
• Right to erasure: the right to request deletion of your Personal Information, subject to applicable legal retention requirements.
• Right to object: the right to object to the processing of your Personal Information, in particular where it is based on our legitimate interest.
• Right to data portability: the right to request that we provide your Personal Information in a commonly used electronic format, or transmit it to another controller, where technically feasible.
• Right to restrict processing: the right to request that we restrict the processing of your Personal Information in certain circumstances.

To exercise any of these rights, please contact us at privacy@degreed.com.

If you are not satisfied with our response, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) by visiting https://www.edoeb.admin.ch, or writing to Feldeggweg 1, 3003 Bern, Switzerland.

If you are a California or Virginia resident, the following information also applies to you and supplements the information contained elsewhere in this privacy policy.

Information we collect and sources of Personal Information

This privacy policy already describes the Personal Information we collect and the sources of Personal Information – see the sections above “What Types of Information Do We Collect?” and “How Do We Get Information About You?”.

In the past 12 months, we have collected the following information for the following purposes:

• Identifiers: This includes, for example, your first name, last name, business email address, social media handles, telephone number and Internet Protocol address, as well as account username or screen name and other online identifiers. We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.
• Internet or other electronic network activity information: This includes, for example, device type, operating system, browser type, and other technical information. We obtain this information automatically in the course of your interactions with our Services.
• Demographic information: This includes information such as age and gender. We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.
• Commercial Information: This includes records of products purchased or considered, or other similar consuming histories. This allows us to provide technical functionality, develop new products and services, and analyze your use of them. We obtain this information directly from you or otherwise automatically in the course of your interactions with our Services.
• Geo-location data: This includes, for example, your locale, zip code, and general geolocation information (based on your IP address). We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.

We collect Personal Information directly from you, automatically from your use of our Services and from certain third-party sources, as described in the section above “How Do We Get Information About You?”.

How we use and share your Personal Information

We use Personal Information for the business and commercial purposes as described in the section above “How Do We Use the Information We Collect?”. We do not share your Personal Information except as approved by you or as otherwise described in this privacy policy. You can find more information in the section above “How Do We Share Your Information?”.

In the preceding 12 months, we have disclosed the following categories of Personal Information for a business purpose:

• Identifiers, as set forth above.
• Internet or other electronic network activity information.
• Demographic information.
• Commercial Information.
• Geo-location data.

We do not your sell your Personal Information. However, we permit certain third-party advertising and analytics partners to collect information about you through our Services for purposes of serving ads that are more relevant and for ad campaign measurement and analytics. For more information or to opt out of the use of your Personal Information for advertising purposes, please see the section above “How Can You Change Your Information Collection Preferences?”.

Your Privacy Rights

As California or Virginia resident you have certain rights. These rights have certain specificities such as timeframes and limitations according to each local law, but in general include, where applicable:

• Right to access: You have the right to request to know more about the categories and specific pieces of Personal Information that we have collected about you and access a copy of your Personal Information.
• Right to erasure: You have the right to request deletion of Personal Information that we have collected about you.
• Right to opt-out: You have the right to opt-out of the processing of your personal data in certain situations as provided by the applicable laws of each state.
• Right to data portability: You have the right to receive a copy of your personal data in a portable, and to the extent technically feasible, readily usable format that permits you to transmit the data to another entity of your choice.

If you are a resident of California or Virginia you also have the right to rectification, meaning the right to correct eventual inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.

Finally, if you are a resident of California or Virginia, you have the right not to be subject to automated decision-making, whenever it produces legal effects or significantly affects you.

If you choose to exercise any of your rights described above, Degreed will treat you like all other users. In other words, there is no penalty for exercising your rights.

To exercise any of these rights, please email privacy@degreed.com or write to us at the physical address listed in the Contact Details section below. You may designate an authorized agent to make these requests on your behalf. For your protection, we may require that the request be sent through the email address associated with your account, and we may need to verify you and/or your authorized agent’s identity before fulfilling your request.

You also have the right to request certain details about what Personal Information we share with third parties for those third parties’ direct marketing purposes. To submit your request, send an email to privacy@degreed.com.

Because there is not yet a common understanding of how to interpret Do Not Track signals, we do not currently respond to “Do Not Track” signals. However, we provide you with the ability to opt-out of the use of tracking technologies to send you interest-based advertising as explained above.

If you are located in Australia, Degreed handles your Personal Information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect, use, and disclose your Personal Information only for the purposes described in this privacy policy, and we do not use or disclose it for a secondary purpose unless you would reasonably expect that use or disclosure, an exception under the APPs applies, or we have your consent.

Australian residents have the following rights:

• Right to access: the right to request access to the Personal Information we hold about you.
• Right to correction: the right to request correction of Personal Information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading.
• Right to anonymity or pseudonymity: where lawful and practicable, the right to interact with us without identifying yourself, or by using a pseudonym.
• Right to complain: the right to make a complaint about how we have handled your Personal Information.

We do not disclose your Personal Information to overseas recipients except as described in the “Cross border transfers of your Personal Information” section above, and, where required by the APPs, we take reasonable steps to ensure overseas recipients handle your Personal Information consistently with the APPs.

To exercise any of these rights, or to make a complaint, please contact us at privacy@degreed.com.

If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC), by visiting www.oaic.gov.au, emailing enquiries@oaic.gov.au, telephoning 1300 363 992, or writing to GPO Box 5218, Sydney NSW 2001.

For users located in Brazil (collectively, “Brazilian Users”), If a Brazilian User accesses or uses our Site or Services, Degreed is the “data controller” of their Personal Information and we perform any processing of your Personal Information in accordance with this privacy policy. The purposes, form and duration of the processing of Personal Information are already described in this privacy policy, as well as information regarding how information is shared.

We process your Personal Information based on one or more of the legal bases set forth in Article 7 of the LGPD, including your consent, the performance of a contract, compliance with a legal obligation, or our legitimate interests, depending on the specific purpose described in this privacy policy.

Brazilian Users have certain data protection rights. These rights include:

• Confirmation that processing of Personal Information exists
• Access to Personal Information processed
• Correction of incomplete, inaccurate, or outdated Personal Information
• Anonymizing, blocking, or deleting Personal Information
• Data portability
• Exclusion of Personal Information
• Information about sharing of Personal Information with other companies
• Information about the possibility of not providing Personal Information
• Withdrawal of consent

To exercise any of the rights outlined above, please contact us at privacy@degreed.com.

Please be advised, we may need to request specific information from you to confirm your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with Brazil’s National Data Protection Authority (Autoridade Nacional de Proteção de Dados – ANPD), by visiting https://www.gov.br/anpd.

Notice to Users in India

If you are located in India (collectively “Indian Users“), Degreed acts as a “Data Fiduciary” under the Digital Personal Data Protection Act (“DPDPA”) with respect to your Personal Information, and we process it in accordance with this privacy policy.

Indian Users have the following rights under the DPDPA:

• Right to obtain a summary of Personal Information processed and the processing activities undertaken
• Right to correction, completion, and updating of Personal Information
• Right to erasure of Personal Information that is no longer necessary for the purpose for which it was collected
• Right to withdraw consent, where consent is our basis for processing
• Right to nominate another individual to exercise these rights in the event of death or incapacity
• Right to grievance redressal

To exercise any of these rights, please contact our Grievance Officer at privacy@degreed.com.

If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India, once operational under the DPDPA.

When we transfer your Personal Information outside India, we do so in accordance with the requirements of the DPDPA and any restrictions notified by the Central Government of India from time to time.

Notice to Users in Canada

If you are a resident of Canada, we collect, use, and disclose your Personal Information only for the purposes identified in this privacy policy, with your knowledge and consent where required, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including Quebec’s Act respecting the protection of personal information in the private sector (Law 25).

Canadian residents have the following rights:

• Right to access: the right to obtain confirmation of whether we hold Personal Information about you, and to access it.
• Right to correction: the right to request correction of inaccurate or incomplete Personal Information.
• Right to withdraw consent: the right to withdraw your consent to our collection, use, or disclosure of your Personal Information at any time, subject to legal or contractual restrictions and reasonable notice.
• Right to challenge compliance: the right to challenge our compliance with applicable privacy law by submitting a complaint to us or to the relevant supervisory authority.
• Right to data portability (Quebec residents): the right to receive, in a structured and commonly used technological format, the Personal Information you have provided us, or to have it transmitted to another entity, where technically feasible.
• Rights related to automated decision-making (Quebec residents): the right to be informed, at or before the time of collection, of the use of any automated decision-making system to render a decision based exclusively on automated processing, and the right to request the reasons for such a decision and to submit observations.

To exercise any of these rights, please contact us at privacy@degreed.com.

We may revise this privacy policy from time to time as we add new features or as laws change that may affect our Site or Services. If we make material changes to this privacy policy, we will let you know in an appropriate manner and we will post a new version number at the beginning of this privacy policy, consisting of the date (year and month) the privacy policy was last revised, so that you will be able to tell when the privacy policy was last changed.

Contacting Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our privacy team directly through the following channels:

• Email: privacy@degreed.com
• Phone: 1-800-311-7061
• Postal Address: 10757 S River Front Parkway, Suite 390, South Jordan, UT 84095

You can directly reach Degreed’s Global Data Protection Officer, Victor Neamt, at privacy@degreed.com. Our DPO and privacy team are committed to reviewing and responding to your privacy-related inquiries within the timeframes required by applicable local laws.

We value your privacy and encourage you to contact us first so we can resolve any concerns promptly. However, you retain the right to lodge a complaint with your local data protection authority at any time if you believe our processing of your personal data does not comply with applicable regulations.