ClickHouse data privacy framework notice

Last modified on May 1, 2024

ClickHouse, Inc., and its affiliates and subsidiaries (“ClickHouse”, “we”, “us” and “our”) have self-certified to comply with the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework (Swiss-US DPF) (collectively “Data Privacy Framework Principles”) as set forth by the US Department of Commerce. If there is any conflict between the terms in this notice and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. ClickHouse will not rely on the Swiss-US DPF until the date of entry into force of Switzerland’s recognition of adequacy for the Swiss-U.S. DPF.

ClickHouse provides database solutions and associated support services including, without limitation, the ClickHouse Cloud software-as-a-service offering. ClickHouse’s certifications to the Data Privacy Framework Principles apply to the personal data that authorized users of ClickHouse’s solutions transfer to us from the European Economic Area ("EEA"), the United Kingdom (UK), or Switzerland for the provision of our services, except where any of our agreements with those businesses stipulate a different transfer mechanism recognized by the relevant authority (e.g. standard contractual clauses). The personal data types that our authorized users upload and store in our services is at their discretion (subject to any limitations in the applicable agreements) and we only process personal data in accordance with their instructions as set forth in those contracts, including the applicable Data Processing Addendum (DPA), a current version of our standard is available at https://clickhouse.com/legal/agreements/data-processing-addendum).

We encourage you to contact us at [email protected] if you have any questions about this Data Privacy Framework Statement or wish to make a complaint concerning our obligations under the Data Privacy Framework Principles. ClickHouse will investigate and attempt to resolve complaints within 45 days after receipt. ClickHouse commits to refer unresolved complaints concerning our handling of personal data received in reliance on the Data Privacy Framework Principles to JAMS, an alternative dispute resolution provider based in the United States.

If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. If neither ClickHouse nor our dispute resolution provider resolve your complaint, you may be entitled to pursue binding arbitration. Further information about binding arbitration or how to file a complaint with the FTC can be found here: https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf.

The Federal Trade Commission (FTC) has jurisdiction over ClickHouse’s compliance with the Data Privacy Framework Principles and ClickHouse is subject to the FTC’s investigatory and enforcement powers with respect to such compliance.

ClickHouse uses third party subprocessors to help us provide our services and those subprocessors may process personal data. ClickHouse remains responsible and liable under the Data Privacy Framework Principles for our third party subprocessors, unless we prove that we are not responsible for the event giving rise to the damage.

Under certain circumstances, ClickHouse may be required to disclose personal data in response to lawful requests by public authorities, including national security or law enforcement requirements.

We may change this Data Privacy Framework Notice from time to time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the website.