Privacy Program Framework

·Fivetran uses the AICPA/CICA Privacy Maturity Model "Privacy Maturity Model" to measure the success of our privacy program. Our philosophy is based on popular privacy concepts such as Privacy by Design and Privacy by Default, but we believe having an excellent privacy program goes beyond those concepts and requires dedicated personnel, policy enforcement, and continuous monitoring. We believe privacy is about using personal data responsibly and in line with customers' and data subjects' expectations.

·Learn more in our Privacy Notice.

·Privacy Certification

·At Fivetran, we believe in creating trustworthy data flows that keep your information secure and private. That's why we've extended our ISO/IEC 27001 certification for information security with the globally recognized ISO/IEC 27701 privacy certification. This certification builds on our strong security foundation by adding a Privacy Information Management System (PIMS), which helps us continually improve how we handle and protect personal data. For our customers, this means you can trust that privacy is not just an afterthought, it's built directly into our policies, processes, and services. With ISO 27701, we're reaffirming our commitment to building trustworthy data flows and helping you meet your own compliance goals with confidence.

·Data protection assessments (PTAs and PIAs)

·We have a process for Privacy Threshold Assessments (PTAs) and for Privacy Impact Assessments (PIAs). The templates are based on ISO privacy standards (29134 and 27701) and are intended to cover a multitude of international regimes that we comply with. We conduct quarterly data protection assessments based on the Privacy Maturity Model, which is intended to cover more than the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data - General Data Protection Regulation (GDPR). It's designed to cover more than the applicable data protection laws in order to truly measure the maturity of our privacy program.

·Privacy by Design and Default

·In addition to our data protection assessment process, we have a privacy engineering guidance playbook to assist our engineers in how to build with privacy in mind in order to comply with Privacy by Design and Privacy by Default principles.

·Dedicated personnel

·We have a Data Protection Officer and dedicated privacy personnel who are accountable and responsible for our compliance with applicable data protection laws.

·Handling of legal access request

·We have a policy to handle these types of requests and will notify customers to the extent permitted under applicable law.

·DSARs and privacy complaints handling process

·We have a process for handling both DSARS and privacy complaints via our privacy@fivetran.com email distribution and have internal training on how to handle those requests as well as specialized privacy personnel who assist in handling requests.

·Data mapping, including a record of data processing activities (ROPA)

·We have a personal data inventory for our systems (which does not scan customer pipeline data). The inventory includes details of data types being processed, such as the data field and whether or not it is sensitive personal data, descriptions of the processing being performed, and transfers of personal data. We use a third party vendor tool to ensure we have a ROPA that complies with GDPR and other strict international privacy law. In addition, our tool provides insights to ensure we have the correct contractual language in place with our third party vendors.

·Data protection legal analysis and keeping up with changing regulations

·We conduct our data protection legal analysis across over one hundred laws and frameworks, monitor changes in applicable law, and analyze our reconciled approach across these laws and frameworks. When we receive an alert for a change in applicable privacy law, we update our legal requirements summaries, our data protection gap analysis matrix across all regimes and our privacy program roadmap as appropriate.

·Compliance with applicable registrations

·We have the necessary data protection registrations under applicable law and can provide registration information in due diligence upon request.

·Health Insurance Portability and Accountability Act (HIPAA)

·Under the HIPAA Security Rule, Fivetran does comply with HIPAA requirements for Protected Health Information (PHI) and will sign a Business Associate Agreement (BAA) with customers who are subject to HIPAA mandates (typically, HIPAA covered entities). Fivetran is not a covered entity under HIPAA rules, and therefore cannot be "HIPAA compliant", since HIPAA itself applies to covered entities (that is, those entities that are subject to regulation by the HHS). Fivetran serves as a data pipeline, which means that PHI traversing the Fivetran environment is not permanently stored. All transmissions are encrypted using industry best practices (at present, TLS 1.2+). Temporary storage may occur when the amount of data transmitted exceeds the capacity for real-time processing, and as a result, requires short-term caching. Such temporary storage is encrypted. All customer data, including PHI, is purged from Fivetran's system as soon as it is successfully written to the destination.

·Cross-border transfers

·We are certified under the EU-US Data Privacy Framework, the UK extension to the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. We can also agree to use Standard Contractual Clauses (SCCs) to comply with cross-border transfers and can provide a Transfer Impact Assessment (TIA) upon request.

·Privacy contractual language

·Our privacy contractual language is intended to comply with GDPR and data protection regimes across the globe. We have templates for customer DPAs, vendor DPAs, and BAAs.

·Required privacy training

·We require all employees to take privacy training at least annually.

·Cookie consent management and audits

·We use OneTrust to manage cookie consent to comply with GDPR and applicable data protection regimes across the globe. We conduct quarterly audits to ensure our legal rules are up to date, the system is working properly, and we are covering all applicable domains.

·Questions

·Ensuring our platform is built with privacy is vital to earning and maintaining our customers' trust. As a leader in automated data integration, we strive to keep Fivetran easy to use while keeping privacy top of mind. To learn more about Fivetran, contact our sales team at sales@fivetran.com. To report a privacy concern, email us at privacy@fivetran.com or DPO@fivetran.com.