Privacy Policy

1. Data Collection & Processing

When we use the term "personal data" in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or anonymized information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

We collect or generate the following categories of personal data in relation to the Services:

• •
  Usage and device information concerning our Users, Prospects and Technology Partners: Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (like type, operating system, mobile device or app id, browser version, location and language settings used), user-customized IDs (where personal data is included), activity logs, the relevant cookies and pixels installed or utilized on your device, and the recorded activity (sessions, clicks, use of features, logged activities and other interactions) of Prospects, Users and Technology Partners in connection with our Services.
  We collect and generate this information automatically, including through the use of analytics tools (including cookies and pixels) - which collect data such as: how often Prospects or Technology Partners visit or use the Sites, which pages they visit and when, which website, ad or email message brought them there, and how Users interact with and use the Platform and its various features.
• •
  Contact and profile information concerning our Customers, Users, Prospects and Technology Partners: Name, email, phone number, position, workplace, profile picture, login credentials, contractual and billing details, and any other information submitted by Account Admins and Users or otherwise available to us when they sign up or log in to the Platform (either directly or through their social media or organizational Single-Sign-On account), when creating their individual profile ("User Profile"), or by updating their account.
  We collect this information directly from you, or from other sources and third parties such as our Customer (your employer), Users and colleagues related to your organizational monday.com account, organizers of events or promotions that both you and us were involved in, and through the use of tools and channels commonly used for connecting between companies and individual professionals in order to explore potential business and employment opportunities, such as LinkedIn, ZoomInfo, Clearbit, Cognism and Lusha.
• •
  Communications with our Customers, Users, Prospects and Technology Partners: Personal data contained in any forms and inquiries that you may submit to us, including support requests, interactions through social media channels and instant messaging apps, registrations to events that we host, organize or sponsor, and participation in our online and offline communities and activities); surveys, feedback and testimonials received; expressed, presumed or identified needs, preferences, attributes and insights relevant to our potential or existing engagement; and sensory information including phone call and video conference recordings (e.g., with our customer experience or product consultants), as well as written correspondences, screen recordings, screenshots, documentation and related information that may be automatically recorded, tracked, transcribed and analyzed, for purposes including analytics, quality control and improvements, training, and record-keeping purposes.

For the purposes of the California Consumer Privacy Act ("CCPA"), specifically in the last twelve (12) months, we have collected the following categories of Personal Information: Identifiers; Professional or Employment-Related Information; Internet or other Electronic Network Activity Information; Customer Records Information; and Geolocation Information. We do not use or disclose sensitive personal information as defined in the CCPA.

2. Data Uses & Legal Bases

We use personal data as necessary for the performance of our Services ("Performance of Contract"); to comply with our legal and contractual obligations ("Legal Obligations"); and to support our legitimate interests in maintaining and improving our Services, e.g. in understanding how our Services are used and how our campaigns are performing, and gaining insights which help us dedicate our resources and efforts more efficiently; in marketing, advertising and selling our Services to you and others; providing customer services and technical support; and protecting and securing our Users, Customers, Prospects and Technology Partners, ourselves and our Services ("Legitimate Interests").

If you reside or are using the Services in a territory governed by privacy laws under which "consent" is the only or most appropriate legal basis for processing personal data as described in this Privacy Policy (either in general, based on the types of personal data you expect or elect to process or have processed by us or via the Services, or due to the nature of such processing) ("Consent"), your acceptance of our Terms and of this Privacy Policy will be deemed as your consent to the processing of your personal data for all purposes detailed in this Privacy Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us at privacy@monday.com.

Specifically, we use personal data for the following purposes (and in reliance on the legal bases for processing noted next to them, as appropriate):

With respect to personal data we obtain from Google OAuth API Scopes, used in our integration with certain Google Services ("Integrated Google Services"), our use of such personal data and data aggregated, anonymized, or derived therefrom ("Restricted personal data"), is limited to the following purposes, in adherence with the Limited Use requirements as detailed in Google API Services Data Policy (version of September 3, 2020):

• •Facilitating, operating, supporting, providing and improving user-facing features that are prominent in the Integrated Google Services (Performance of Contract; Legitimate Interests);
• •Troubleshooting or security purposes (such as investigating a bug or abuse), subject to the Users' prior consent, insofar access to Restricted personal data is required to resolve a support issue (Performance of Contract; Legitimate Interests);
• •Compliance with applicable law and regulations (Legal Obligation);
• •For our internal operations, provided that the Restricted personal data (including derivations thereof) have been aggregated and anonymized (Legitimate Interests);
• •Transfer of the Restricted personal data to third parties: (1) in accordance with this Privacy Policy, solely to the extent necessary to provide or improve the Integrated Google Services; (2) to comply with applicable laws and regulations; and (3) in connection with any change in control, including by means of merger, acquisition or purchase of substantially all of monday.com's assets (Performance of Contract; Legitimate Interests; Legal Obligation); or
• •Otherwise in strict accordance with your affirmative agreement.

3. Data Location & Retention

Data Retention: We may retain your personal data for as long as it is reasonably needed to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes, all in accordance with our data retention policy and at our reasonable discretion. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements. If you have any questions about our data retention policy, please contact us by email at privacy@monday.com.

4. Data Disclosure

We may disclose personal data in the following instances:

5. Cookies and Tracking Technologies

Our Sites and Services utilize "cookies", anonymous identifiers, pixels, container tags and other technologies in order for us to provide and monitor our Services and Sites, to ensure that they perform properly, to analyze our performance and marketing activities, and to personalize your experience. To learn more about our practices concerning cookies and tracking, please see our Cookie Policy.

Please note that we do not change our practices in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application, however, most browsers allow you to control cookies, including whether or not to accept them and how to remove them.

6. Communications

We engage in Services and promotional communications, through email, phone, SMS and notifications.

Services Communications: We may contact you with important information regarding our Services. For example, we may send you notifications of changes or updates to our Services, billing issues, log-in attempts or password reset notices, etc. You can control your communications and notifications settings from your User Profile settings, however, please note that you will not be able to opt-out of receiving certain Services communications which are integral to your use.

Promotional Communications: We may also notify you about new features, additional offerings, events and special opportunities or any other information we think you will find valuable. If you do not wish to receive such promotional communications, you may notify monday.com at any time by sending an email to privacy@monday.com, changing your communications preferences in your User Profile settings, or by following the "unsubscribe", "stop", "opt-out" or "change email preferences" instructions contained in the promotional communications you receive.

7. Data Security

In order to protect your personal data held with us, we use industry-standard physical, procedural and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties. To learn more, please visit our Trust Center.

8. Data Subject Rights

If you wish to exercise your privacy rights under applicable law (including the EU or UK GDPR, Swiss Federal Data Protection Act or the CCPA), such as the right to know/request access to, to request rectification or erasure of your personal data held with monday.com, or to restrict or object to such personal data's processing, or to obtain a copy or port such personal data, or the right to equal Services and prices – please contact us by email at support@monday.com. If you are a GDPR-protected individual, you also have the right to lodge a complaint with the relevant supervisory authority in the EEA or the UK, as applicable.

You may designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. In such cases, we may request further information to verify such power of attorney and authorization.

Please note that when you ask us to exercise any of your rights under this Privacy Policy or applicable law, we may require additional information and documents, including certain personal data and credentials in order to process your request in a proper manner. We may redact from the data which we make available to you, any personal or confidential data related to others.

9. Data Controller/Processor

Certain data protection laws and regulations, such as the GDPR or the CCPA, typically distinguish between two main roles for parties processing personal data: the "data controller" (or under the CCPA, "business"), who determines the purposes and means of processing; and the "data processor" (or under the CCPA, "service provider"), who processes such data on behalf of the data controller.

monday.com Ltd. is the "data controller" of its Prospects', Users', Technology Partner's and Customers' personal data, as detailed in Section 1 above. Accordingly, we assume the responsibilities of a data controller as set forth in this Privacy Policy.

monday.com is the "data processor" of personal data contained in Customer Data, as submitted by our Customers and their Users to their Account's boards, items and docs. We process such data on behalf of our Customer and in accordance with our Data Processing Addendum and other commercial agreements with such Customer.

If you would like to make any requests or queries regarding personal data we process as a data processor on our Customer's behalf, including accessing, correcting or deleting your data, please contact the Customer's Account Admin directly.

10. Additional Notices