Privacy Notice

1. Scope of this privacy notice.

The purpose of this privacy notice is to inform you, the data subject, of the scope of personal data processing related to phone and video call recording of calls between you and Vectra AI, Inc. (“Vectra”) sales representatives.

Vectra’s Privacy Policy governs the use and storage of your personal data. You can see our Privacy Policy at www.vectra.ai/privacy_policy. Vectra processes personal data in a transparent and lawful way. Any personal data provided by you will only be used in accordance with Privacy Policy, and as specifically detailed in this Privacy Notice.

Vectra is a Controller of the personal data you provide us. We may collect the following types of personal data from you:

• First and last name
• Role/position at your current company
• Geographical location
• Professional contact details such as email, phone number, or other means of professional contact
• Voice identifiers and business insights stemming from our communications with you (correspondences, sensory information including call and video recordings, and transcriptions and analyses thereof).

2. Why do we need your personal data?

We need your personal data in order to provide you with the following services:

• To progress discussions about how Vectra can provide your organisation with AI-driven cyber threat detection and response services, and ancillary service offerings.

3. Lawfulness of data processing.

Vectra’s processing of your personal data, in relation to the scope covered under this privacy notice, is derived from:

• Consent: Prior to the commencement of a video conference call with Vectra, you are given the opportunity to explicitly consent or decline to be recorded. For phone calls, an automated prompt will inform you that the call will be recorded, and you will have the opportunity to inform a Vectra representative to you do not wish to be recorded, or confirm your consent by simply continuing with the phone call. You are able to withdraw your consent at any time, and request the deletion of any recordings which have not yet been purged from our systems in accordance with our retention schedule, as documented in paragraph 5 below.

• Legitimate interest: Personal data derived from recorded conversations may be processed on the basis of Vectra’s legitimate business interests in promoting its services to you and the organisation you represent, and to create aggregated statistical data, inferred non-personal data, or anonymized or pseudonymized data (rendered non-personal and non-identifiable), which Vectra may use to provide and improve our respective services, or for any other legitimate business purpose.

• Performance of a contract: Personal data derived from recorded conversations may be processed pursuant to the performance of contract between your organisation and Vectra, or in order to take steps at your request prior to entering into such a contract.

4. How and where your personal data is processed.

Your personal data is processed by Vectra, as well as its nominated sub-processor, Gong.io Inc., and other agents or sub-processors of Vectra (collectively, “Third Parties”) for the purpose documented in paragraph 2 above. Where Third Parties are engaged, they will only process your personal data on the basis of a lawful data processing agreement entered into with Vectra. Hosting and storage of your data takes place within the United States, the EEA, and other locations, as reasonably necessary for the proper performance and delivery of our services, or as may be required by law. If you are resident within the European Economic Area (EEA), Switzerland, or the United Kingdom, where your personal data is transferred outside of these territories to a jurisdiction which does not have an adequacy decision awarded by the European Commission, such transfer will only be made on the basis of a legally permissible transfer mechanism, such as the Standard Contractual Clauses published by the European Commission.

5. How long we keep your data.

We will only process your personal data for such time as a valid legal basis of processing exists, and after this period, your personal data will be irreversibly destroyed. With respect to call recordings processed on the basis of your explicit consent, other than for transcripts or derived insights, such recordings will be deleted from our systems within 12 months of the recording date. Any personal data held by us for marketing and service update notifications will be kept by us until such time that you notify us that you no longer wish to receive this information.

6. What are your rights?

Should you believe that any of your personal data held by Vectra pursuant to the processing activity covered under this Privacy Notice is incorrect or incomplete, you have the ability to request to see this information, rectify it or have it deleted. In the event that you wish to exercise your rights as a data subject, or complain about how we have handled your personal data, please contact our Privacy Team at privacy@vectra.ai. Our Privacy Team will then look into your complaint and work with you to resolve the matter. If you still feel that your personal data has not been handled appropriately according to applicable law, you are able to contact your jurisdiction’s data protection authority directly, and follow the applicable complaints process.

You are able to object to the collection or use of your personal data whenever data is processed for the legitimate interest of Vectra, however Vectra may continue to collect or use such data where Vectra can demonstrate compelling overriding legitimate grounds for the processing, or for the establishment, exercise, or defence of legal claims.