ARCHIVE: ClickHouse Privacy Policy

Last modified on March 18, 2022

This Privacy Policy describes how ClickHouse, Inc. and it affiliates and subsidiaries (“ClickHouse”, “we”, “us” and “our”) processes information about you in connection with our business.  It covers personal information that is provided to us via websites that link to this Privacy Policy (the “Sites”) and your registration or participating in sales and marketing events sponsored by our partners or by us. It also covers certain information (such as account data and usage data, as described below) that is provided to us via your use of our Software-as-a-Service (SaaS) offering.  This Privacy Policy also describes certain rights that you have with regard to our processing of your personal information.  We provide additional information for California residents and European residents as identified below. 

Our SaaS offering is a cloud-based service through which authorized users may access and use the ClickHouse column-oriented DBMS (columnar database management system) for online analytical processing (OLAP) (the “Cloud Service(s)”).  We also offer support and professional services to better enable authorized users to configure and use the Cloud Services (such services, together with the Cloud Services, the “Services”).  We provide the Services to authorized users pursuant to a customer agreement between ClickHouse and the applicable customer.  

This Privacy Policy does not apply to data that authorized users upload or otherwise ingest into the Services or otherwise provide to us in connection with support or professional services (collectively, “Content”).  We process such Content pursuant to instructions provided by the customer (i.e., the customer is the “controller”, and we are the “processor”) and our processing is governed by the applicable customer agreement.  To the extent that your personal information is included as Content that is provided to us by a customer, you should refer to the applicable customer privacy statement regarding the customer’s processing of your personal information and your rights with respect to such processing.

We recommend that you read this Privacy Policy in its entirety to ensure you are fully informed. Nevertheless, if you only want to access a particular section of this Privacy Policy, then you can click on the relevant link below to jump to that section.

Personal Information We Collect
How We Use Personal Information
How We Share Personal Information
Your Choices
Processing Personal Information in the US
Other Sites and Services
Data Security
Children
Changes to This Privacy Policy
How to Contact Us
Notice to European Residents
Notice to California Residents

Information you provide to us, such as:

• Registration, contact and account data. This information is provided to us when you create an account for a Service (“account data”) or when your register with our website(s), e.g., to attend an event or obtain training or get access to a whitepaper) and includes information such as your first and last name, email address, job function, company name, company size and other information relating your interest in our company or our Services (e.g., type of use case, type of training, etc.).
• Payment and transaction data. If you enter into a self-service transaction with us, we will collect payment and transaction data.  This information is collected by our payment service provider and we do not have access to payment card numbers.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing data, such as your preferences for receiving our marketing communications, and details about your engagement with them.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third party sources. We may also obtain personal information about you from other sources, such as:

• Marketing and/or Business Partners, such as contact information from business partners with whom we operate co-branded events or other data providers, search results and links from third-party advertisers, and credit history information from credit bureaus.
• Integrated Services Providers, such as transaction information from our payment service provider.
• Resellers, Distributors, Joint Marketing/Co-Hosted Event Providers,  such as contact information and conference attendance information from events providers.  
• Social Media Platforms, such as  search results and links, including paid listings (such as sponsored links).

Automatic data collection. We may automatically log information about you when you visit the Sites and/or when you use our Services.

When you visit our Sites, we may automatically collect device data such as the type of computer or mobile device that you are using or your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 5G), and general location information such as city, state or geographic area.

When you visit our Sites, we may also automatically collect online activity data  such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to our Site, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access, and whether you have opened our marketing emails or clicked links within them.  

When you use our Cloud Services, we automatically collect certain data (“usage data”) relating to the configuration, use and performance of the Cloud Service by the account holder and other authorized users of the Cloud Service.  Such data may include:

• Information about the authorized user’s equipment, such as a user ID or IP address, user email address and/or information about the user’s device (e.g., type of computer or mobile device) and software (e.g., operating system and/or browser versions)
• Information about the authorized user’s activity, such as click patterns, features accessed, commands used within the Cloud Service, types and size of data and files analyzed by the Cloud Service and other statistical information.
• Technical information about the Cloud Service, such as log files that are generated in connection with access, use and maintenance of the Cloud Service. 

To the extent that usage data collected includes personal data, we will process such data in accordance with the terms of this Privacy Policy.

We use standard automated data collection tools such as cookies, web beacons, tracking pixels and the to collect data from our Sites and Service.  For more information on the use of cookies and other tracking technologies, including how to opt out of certain collection, please see our Cookie Policy.   We may share information about your computer or other device with our third-party service providers for information and network security, including fraud detection.

We use your personal information for the following purposes or as otherwise described at the time of collection:

Site Operation and Services delivery. We use your personal information to:

• Provide, operate, audit and improve our Sites, our Service and our business;
• Communicate with you about our Sites and our Service, including by sending invoices, announcements, updates, security alerts, and support and administrative messages; 
• Provide customer service and support, and respond to your requests, questions and feedback; 
• Maintain your account(s); and
• Detect bugs, report errors and perform activities to maintain the quality or safety of our Sites and Services.

Research and Development.  To research, develop, create and implement new features and capabilities for our Sites and our Services. 

Marketing and Advertising/Customer Experience. We may use personal information for marketing and advertising purposes and to improve your customer experience, including to: 

• Better understand you and your preferences so that we may personalize your experience when using our Sites and/or Services**;**
• Conduct contests or other marketing campaigns and process awards or rewards;
• Link or combine it with other personal information we get from third parties, to further develop our understanding of you and your preferences and/or to prevent fraud
• Send you marketing communications about our Sites and our Service; and
• Evaluating the effectiveness of our marketing campaigns.

Interest-based advertising. We engage our advertising partners, including third party advertising companies and social media companies, to advertise our Service. We and our advertising partners may use cookies, clear gifs and similar technologies to collect information about your interaction (including the data described in the “Automatic data collection” section above) over time across the web, our communications with you and our Sites, and use that information to serve online ads. 

This Privacy Policy does not apply to, and we are not responsible for, cookies or clear gifs in third party ads, and we encourage you to check the privacy policies of advertisers and ad services providers and social media companies to learn about their use of cookies and other technology. You can learn more about your choices for limiting interest-based advertising in the “Online tracking opt out” section below. 

Compliance and protection. We may use personal information to:

• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;
• Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
• Audit our internal processes for compliance with legal and contractual requirements and internal policies;
• Enforce the terms and conditions that govern our Site(s) and Service; 
• Enhance security and to monitor and verify identity or service access; and
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, malicious, unethical or illegal activity, including cyberattacks and identity theft.

We may share your personal information with:

Service providers. Companies and individuals that provide services on our behalf or help us operate our Sites, our Services or our business (such as hosting, information technology, customer support, email delivery, and website analytics services).

Business partners.  Distributors, resellers, referral partners and similar third parties that are involved in the marketing, sales or delivery of our services.  From time to time, we may engage in joint sales or promotional activity with select business partners. If you purchase or specifically express an interest in a jointly offered product, promotion or service, we may share your personal information with the relevant partner. With your consent, these business partners may also send you marketing communications about their own products and services.

Advertising partners. When you visit our Sites, third party advertising companies may use automated technologies to collect information for interest-based advertising purposes described above. We do not allow advertising partners to collect this data from our web application after you log into your ClickHouse account.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Other business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Company or our affiliates (including, in connection with a bankruptcy or similar proceedings).

ClickHouse Affiliates.  If your personal information is shared with our affiliates, the processing of the personal information will remain subject to this privacy statement.

As you instruct us.  We may also share your personal information where you instruct us to do so or where you have provided consent (for example, when you agree to share your information with third parties for their own marketing purposes, subject to their data protection policies).  

Opt out of marketing communications. You may opt out of marketing-related communications by following instructions contained in the marketing communications we send you. If you opt out, we may still send you emails that are not marketing related, such as emails about your accounts or our ongoing business relations. 

Online tracking opt-out.  For a description of how you may opt-out of online tracking (e.g., cookies), see our Cookie Policy. 

We have personnel and use service providers located in the United States. To provide our Service and operate our Sites, it is necessary for us to process personal information in the United States.

Our Sites and Services may contain links to websites and other online services operated by third parties, including social media sites such as Facebook. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. Your use of the third-party websites, applications and any information you authorize us to send to the third-party will be subject solely to the third-party’s terms and conditions and privacy notice, and will not be subject to any agreements you have with us or this Privacy Policy.

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

The Service are not intended for use by children under 18 years of age. If we learn that we have collected personal information through our Service from a child under 18 without the consent of the child’s parent or guardian as required by law, we will delete it.

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the website. 

You can reach us by email at [email protected] or at the following mailing address:

ClickHouse, Inc.
650 Castro St. Ste. 120 Unit 92426
Mountain View, CA 94041
USA

Attn:  Privacy Practice Group

Controller. ClickHouse is the controller of your personal information covered by this Privacy Policy for purposes of European data protection legislation.

Legal basis for processing. We use your personal information only as permitted by law. Our legal bases for processing the personal information described in this Privacy Policy are described in the table below.

Processing Purpose	GDPR Legal Basis
Site Operation and Services delivery	Processing is necessary to perform the contract governing our provision of our services or to take steps that you request prior to signing up for the Services. If we have not entered into a contract with you, we process your personal information based on our legitimate interest in providing the information and/or services you access and request.
Research and development Marketing and advertising/Customer Experience Compliance and protection	These activities constitute our legitimate interests. We do not use your personal information for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Comply with law	Processing is necessary to comply with our legal obligations

**Use for new purposes.** We may use your personal information for reasons not described in this Privacy Policy where permitted by law and where the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive personal information. We ask you not to provide any sensitive personal information to us because we do not have the ability to identify or offer enhanced protections for sensitive personal information. If you choose to provide us with any sensitive personal information, we will process it as “personal information” in accordance with this Privacy Policy. 

Your rights. Data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.

• Correct. Update or correct inaccuracies in your personal information.

• Delete. Delete your personal information.

• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.

• Restrict. Restrict the processing of your personal information.

• Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.

You may submit these requests by email to [email protected] or our postal address provided above. 

We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

Processing of personal information in the United States. To provide our services we will process your personal information in the United States for the purposes we have set out in this Privacy Policy. If such processing involves the transfer of personal information to the United States in a manner governed by European data protection law, the transfer will be performed pursuant to the applicable requirements of the law, such as standard contractual clauses, the individual’s consent, or in other circumstances permitted by European data protection law.

Data retention. We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

We are providing this supplemental privacy notice to California residents, pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). 

Under the CCPA, until January 1, 2023, this Notice to California Residents and the privacy practices and rights it describes do not apply to the information we collect, use or disclose about individuals who represent businesses that provide services to us or to which we provide our Services.  

The CCPA grants California residents the following rights:

• Information.Our Privacy Policy describes how we use and share your personal information, including during the past 12 months. We describe the sources through which we collect personal information and the types of personal information collected in the Personal Information We Collect section above. We describe the purposes for which we use and share this information in the How We Use Personal Information section above and the How We Share Personal Information section above.
• Access. You can request a copy of the personal information that we maintain about you.
• Deletion.You can ask to delete the personal information that we maintain about you.
• Opt-out of the sale of your personal information.We do not “sell” personal information, as we understand sale to be defined by the CCPA and its implementing regulations. Like many companies, we use services that help deliver interest-based ads to you. You can limit the use of tracking technologies, such as cookies, by following instructions in the Online tracking opt-out section above. 

Please note that the CCPA limits these rights by, for example, prohibiting businesses from providing certain sensitive information in response to an access request and limiting the circumstances in which they must comply with a deletion request.

You are entitled to exercise the rights described above free from discrimination.

Here is how you can submit requests:

• To request access to or deletion of personal information collected via our Services, please email us at [email protected]
• To learn how to limit tracking, please see the Online tracking opt-out section above.
• To verify your identity prior to responding to your requests, we may ask you to confirm information that we have on file about you or your interactions with us. Where we ask for additional personal information to verify your identity, we will only use it to verify your identity or your authority to make the request on behalf of another consumer.
• Authorized agents. California residents can empower an “authorized agent” to submit requests on their behalf.