This Data Privacy Framework Notice ("Notice") is provided by The Constant Company, LLC and its affiliates (collectively, "Vultr", "we", or "us") and forms part of our overall Privacy Notice.
As an organization participating in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), we are committed to protecting the personal data of individuals in the European Union, the United Kingdom, and Switzerland.
Vultr complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Vultr has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Vultr has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
We are subject to enforcement by the U.S. Federal Trade Commission (FTC) with respect to our compliance with the DPF Principles.
We may collect personal data that you provide, including:
We process personal data to:
We may disclose personal data to service providers that perform functions on our behalf (subprocessors), our affiliates and subsidiaries, third-party advertisers and analytics providers, and law enforcement and other government agencies, as required by law. You can see a list of our sub-processors here.
We offer individuals the opportunity to choose (opt-out) whether their personal data is to be disclosed to a third party (other than our service providers performing tasks on our behalf) or used for a purpose materially different from the purpose for which it was originally collected. If you wish to limit the use or disclosure of your personal data, you may submit a request to our Privacy Department at privacy@vultr.com.
We may be required to disclose personal information in response to lawful requests from public authorities, including national security or law enforcement requests. Such disclosures are made only when legally required, and we take reasonable steps to ensure they comply with applicable laws.
As an IaaS provider operating under a shared responsibility model, we may transfer personal data to subprocessors or third-party service providers. We require these third parties to implement privacy and security safeguards that meet or exceed our obligations under the DPF. We remain accountable for onward transfers of personal information.
Individuals have the right to:
In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), Vultr commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Vultr at privacy@vultr.com.
Vultr has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.
We retain personal data only as long as necessary to fulfill the purposes described in this Notice, comply with legal obligations, or enforce agreements. Retention periods may also depend on customer configurations in our IaaS platform.
To learn more about the Data Privacy Framework program and to view our certification, please visit https://www.dataprivacyframework.gov/list.
If you have any questions or concerns about our participation in the Data Privacy Framework or our processing of personal data, please contact us at:
Tempestt Woody
privacy@vultr.com