Privacy at Airtable

·Privacy at Airtable

·Keeping your Personal Data Safe Privacy at Airtable 1

·Table of Contents

·Overview

·Privacy Program

·Airtable has a dedicated privacy program that manages privacy processes and safeguards to protect our customers' personal data and respect individual privacy rights. Our program monitors privacy laws and regulations, maintains privacy documentation, implements privacy controls, responds to data subject requests, and more. Our program works in collaboration with our security and compliance teams to implement internal policies and procedures, provide privacy and security training to all employees on an annual basis and to contractors on a per-role basis, and raise awareness of privacy compliance requirements across our company.

·Airtable's Privacy Principles

·Proactive. Airtable complies with regulatory requirements as a baseline standard for our privacy program. In addition, we actively identify areas of our program that we can enhance to support our customers' evolving privacy needs and prepare for upcoming laws and regulations.

·Secure. Airtable implements technical and organizational measures based on industry best practices to protect customer personal data. Airtable is certified to the ISO 27001 and SOC 2 Type 2 standards, demonstrating our commitment to safeguarding customer personal data and respecting international standards.

·Trustworthy. Airtable is transparent about our privacy practices, so customers can trust our platform with their important data and business processes.

·Compliance with Privacy Laws and Regulations

·General Data Protection Regulation and California Consumer Privacy Act

·Airtable's privacy program is designed for compliance with global privacy laws and regulations, including Europe's General Data Protection Regulation (GDPR), the United Kingdom GDPR, and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The GDPR is one of the world's most stringent privacy regulations, while the CCPA is the first comprehensive privacy law in the United States. Airtable aligns its practices with the GDPR and the CCPA/CPRA, while also taking proactive action to monitor developments in the ever-changing privacy landscape across the globe.

·Privacy Policy

·Airtable processes customer personal data in accordance with our Privacy Policy, and any applicable Data Processing Addendum (described below). Airtable's Privacy Policy describes our practices with respect to the collection, use, and disclosure of personal data, and is reviewed at least annually for compliance with privacy laws and regulations. It also provides information about how individuals may exercise their privacy rights under applicable privacy laws. The Privacy Policy is available at www.airtable.com/privacy.

·Data Subject Requests

·Airtable fulfills data subject requests for access, correction, deletion, and portability in accordance with applicable laws where our users are based. Data subject requests may be submitted through this form or by emailing privacy@airtable.com. This information is also accessible via our Privacy Policy.

·Consent

·Per our Privacy Policy and Cookie Policy, Airtable respects the privacy rights of our users and provides mechanisms for users to manage certain cookie preferences based on their region and to opt out of marketing communications.

·Record of Processing Activities (ROPA)

·Airtable has conducted data mapping exercises and maintains a record of processing activities which helps us better understand and manage the personal data we control or process. In Airtable's role as a processor, we do not keep records regarding the specific personal data that our customers may store in the Airtable platform. We recommend that our customers keep their own record of processing activities as it relates to their use of Airtable.

·Data Processing Addendum (DPA)

·Airtable supports our customers' privacy obligations by offering a pre-signed DPA that sets out the terms that apply when a customer's personal data is processed by Airtable, including the appropriate technical and organizational measures implemented to protect such personal data. Our DPA helps our customers ensure that Airtable's processing of customer personal data is conducted in accordance with applicable privacy laws and respects the privacy rights of individuals. Please reach out to your Airtable representative for more information on how to view and sign the DPA.

·Cross-Border Data Transfers

·Airtable's servers are located in the United States (US) and hosted using US-based AWS servers (US-East-1). The GDPR requires organizations to use appropriate security and legal mechanisms to transfer personal data from the European Union (EU) or United Kingdom (UK), to a country outside of the EU or UK, such as the US. To support our customers' obligations with respect to data transfers, Airtable has incorporated the EU Standard Contractual Clauses (EU SCCs), and the UK Data Transfer Addendum to the Standard Contractual Clauses (UK SCCs), into our DPA. The EU SCCs and UK SCCs are pre-approved by the European Commission and the UK's Information Commissioner's Office, respectively, to be used by organizations as appropriate data transfer mechanisms under the GDPR.

·Subprocessors

·Airtable uses subprocessors to provide core infrastructure and other services. Prior to engaging any subprocessor, Airtable evaluates their privacy, security, and confidentiality practices, and executes an agreement implementing applicable privacy and security obligations, including an appropriate data transfer mechanism where required. For more information and a list of our subprocessors, please visit www.airtable.com/subprocessors.

·Government Rights of Access

·Airtable employs appropriate technical and organizational safeguards to protect personal data. All personal data is encrypted in transit and at rest to prevent unauthorized access by third parties. In the event that Airtable receives a request under applicable law or legal process to disclose customer personal data, Airtable will assess the validity of the request and act solely as required by applicable law and in accordance with the terms of any applicable services agreement, our Privacy Policy, and any executed DPA. Subject to these requirements, Airtable will use commercially-reasonable efforts to notify the customer in advance of disclosing its confidential information in response to a legal request or legal process, so that the customer may seek a protective order or take other action in relation to the request.

·Security Measures that Support Privacy

·Airtable's privacy program works in conjunction with our compliance and security programs to implement and adhere to strict internal controls and international standards, such as ISO 27001 and SOC 2 Type 2. These security controls and standards keep our customers' personal data secure via industry-standard measures such as: incident response and management, endpoint security, network security, encryption, access control, and data retention and disposal.

·For more information about Airtable's security posture and a more exhaustive list of the security measures we use to protect the privacy of our customers' personal data, please see https://www.airtable.com/security and our Security Whitepaper.

·Privacy Best Practices for Customers Using Airtable

·Airtable aims to provide our customers with resources to support their privacy and security needs while using our products and services. Customers can find product resources at https://support.airtable.com/. Here are a few examples of privacy and security features that customers can learn more about on our website:

• ·Managing user access and appropriate levels of permissions to workspaces, including via the Enterprise Admin Panel (which can be used to appoint enterprise admins, activate/deactivate users, or implement single sign-on (SSO))
• ·Managing access to shared links on workspaces, including restricting access
• ·Third-party integrations via OAuth (which allows users to grant API access to their Airtable resources with third-party services)

·Conclusion

·Airtable drives global privacy compliance through proactive, secure, and trustworthy policies and practices. The protection of our customers' personal data is one of our most important responsibilities. We are committed to providing resources to support our customers' needs, and keeping customers' personal data secure.

·Our privacy team is here to answer any questions you may have. You can reach us by emailing privacy@airtable.com or by reaching out to your contact at Airtable. Privacy at Airtable 7