Fivetran Privacy Policy

·Privacy

·Learn how Fivetran respects our users' right to privacy. For more details, see our Privacy Program Framework.

·See previous versions of Fivetran Privacy policies in the Archived versions documentation.

·Retention of customer data

·How long we retain customer data depends on the data type:

·In the following two cases, customer data is purged as soon as it is successfully written to the destination. If the data writing process takes longer than usual, the data is automatically purged after 30 days using object lifecycle management:

• ·Destination outage: If your destination is down, we maintain the data that we've read from your source so that we can resume the sync without losing progress once the issue is resolved.
• ·Schema information for data blocking or column hashing purposes: If you choose to block or hash columns before running the initial sync for your new connection, we query your data source and cache your data while we fetch the full schema. We write to the destination only the data you selected as tables and columns from the fully fetched schema and only when you approved the selection.

·Fivetran data residency

·Fivetran runs data connections on servers in the United States (US), Canada, European Union (EU), United Kingdom (UK), Australia, Singapore, India, Japan, Indonesia, and the Middle East. You can select your preferred data processing location when configuring your destination. All connections configured in a destination run in the destination's designated location. This means that in most cases, your data will not leave our region-specific servers during processing. For example, if you configure your destination to use our EU servers, your data will not leave the EU during processing. See our destination documentation to learn how to configure your data processing location.

·Certain connectors are exceptions to this policy, such as the email connector and connectors that sync webhooks and event data as well as customer support requests unless you have purchased Fivetran's U.S.-only support option. By default, we store email connector and event data in a cloud storage service in one of the following data processing locations:

• ·the EU location - for destinations run in the EU location
• ·the UK location - for destinations run in the UK location
• ·the US location - for all other destinations

·Fivetran runs our services on Google Cloud Platform (GCP), Amazon Web Services (AWS), and Azure. The following table lists regions supported by Fivetran for each service provider:

·*Default region for a given cloud provider / geography combination. For some cloud providers and geographies, there is only one region available.

·Google Cloud Platform is the default cloud service provider. Google Cloud Platform is your only cloud service provider if you're on a Standard or Free plan. You can select a different cloud service provider if you are on an Enterprise or Business Critical plan.

·Regardless of the plan you use, you can select the Fivetran processing geography when creating a destination. Fivetran processing is specific to how we read data from your source location. If you are on an Enterprise or Business Critical plan, you also can select the cloud service provider. Lastly, if you are on a Business Critical plan, you can select a cloud region.

·You need to safelist the corresponding Fivetran IPs in your firewall for the geography and region you selected for your destination.

·Sub-processor management

·Fivetran uses certain subprocessors to assist us in providing the Fivetran Services as described in the Terms of Service (TOS). We maintain a list of sub-processors and provide notice for any additions.

·Defined terms used herein shall have the same meaning as defined in the TOS.

·What is a Subprocessor?

·A subprocessor is a third-party data processor engaged by Fivetran, including entities from within the Fivetran Group, who has or potentially will have access to or process personal data on behalf of a Customer. Fivetran engages different types of subprocessors to perform various functions as explained in the tables below. Fivetran refers to third parties that do not have access to or process personal data on behalf of a Customer, but who are otherwise used to provide the Services, as "subcontractors" and not "subprocessors". The list includes the ability for our customers to request a preferred email contact to receive notifications of changes. Customers may send their preferred email contact to privacy@fivetran.com.

·Pipeline Data Subprocessors

·These are subprocessors who have access to Fivetran production systems and data by virtue of the services they provide.

·AI Subprocessors

·Affiliates

·Fivetran Inc. maintains affiliate companies in countries where our full-time employees work. Each of these affiliate companies comprises members of the Fivetran team who contribute from outside the United States.

·Access

·Please see our Diagnostic Data Access process for more detail on how we access customer data.

·Additionally, for customers that cannot have data access from countries outside of the United States, Fivetran offers U.S. only support for an additional cost.

·Fivetran uses a single sign-on (SSO) service to manage access control and permission provisioning, based on user role within the organization. Role-based access is established through Fivetran's single sign-on providers which is integrated with Fivetran's Human Resources system. Employee role assignments are automatically updated when employment is terminated or departments/roles change. In addition, Fivetran performs quarterly user access reviews of access to customer facing systems.

·Questions

·Ensuring our platform is built with privacy is vital to earning and maintaining our customers' trust. As a leader in automated data integration, we strive to keep Fivetran easy to use while keeping privacy top of mind. To learn more about Fivetran, contact our sales team at sales@fivetran.com. To report a privacy concern, email us at privacy@fivetran.com or DPO@fivetran.com.