Last Updated: Dec 10, 2024

This Privacy Policy (“Privacy Policy”) outlines how Liferay (as further defined below) processes your Personal Data (as defined below) that Liferay collects from you or obtains from third parties, as applicable. It also describes the choices available to you regarding our use of your Personal Data and how you can access and update this information. Any Personal Data provided to us will be treated according to the terms of this Privacy Policy. 

What you will find here:

SCOPE OF THE PRIVACY POLICY
When does this Privacy Policy apply
Other Statements, Policies and Notices
This Privacy Policy does not apply in the context of:
Certain FOSS Projects and Co-Branded Websites
DEFINITIONS
DATA CONTROLLER AND CONTACT INFORMATION
YOUR PERSONAL DATA
HOW AND ON WHAT LEGAL BASE LIFERAY PROCESSES YOUR PERSONAL DATA
     How Liferay uses your Personal Data in connection with a contract
          Identify and Authenticate You
          Fulfill Your Requests
          Creating and operating user profiles
          Provide Support and Customer Service
          To perform other processing activities required as part of the business relationship
     How Liferay uses your Personal Data for compliance purposes
          To ensure compliance
          Export Control
          Anti-Corruption and Anti-Money Laundering
          Your Content
     How Liferay uses your Personal Data to pursue Liferay’s legitimate interests, unless your consent is required
          Creation of aggregated or demographic data sets
          Improve accuracy and completeness of data for targeting
          Security of our systems, data and content
          Enforcement of claims/retention
          Creditworthiness
          Audits
          Right to object
     Communication on the basis of legitimate interest, unless your consent is required
          Keep you up-to-date/request feedback
          Marketing Communication
          Questionnaires and surveys
          Enabling Exchange
          Right to object
     How Liferay uses your Personal Data based on your consent we obtain
          Special Categories of Personal Data
          Recording or transcribing of calls for documentation and quality improvement purposes
          Testimonials
          Request feedback
          Marketing Communication
          Questionnaires and surveys
          Enabling Exchange
          Withdrawal of a consent granted hereunder
COOKIES AND SIMILAR OR RELATED TECHNOLOGIES
     Cookies
          Cookie Policy
                    Categories of Cookies Liferay uses
                              Strictly Necessary Cookies
                              Performance Cookies
                              Functional Cookies
                              Personalisation Cookies
                    Your Choices
     Similar or Related Technologies
          Local Storage Objects
          Web Beacons, Pixels and Tags
          Behavioral Targeting/Re-Targeting
          Analytics/ Log Files
HOW LIFERAY DISCLOSES YOUR PERSONAL DATA
     Based on your request
          Public forums and profiles
          Liferay Community
     Based on your consent
          Testimonials
     Other cases
          Parties that support Liferay operations
          Investigations and Proceedings
CROSS-BORDER DATA TRANSFERS AND DATA PRIVACY FRAMEWORKS
     If you are located in the EEA, UK or Switzerland
          General conditions of cross-border transfers
          EU-U.S. Data Privacy Framework with UK Extension and Swiss-U.S. Data Privacy Framework
     If you are located in Brazil
RETENTION OF YOUR PERSONAL DATA
     Your rights
          If you are a California (US) resident
     Your Choices
CHILDREN’S ONLINE PRIVACY
CHANGES TO THIS PRIVACY POLICY
HOW TO CONTACT LIFERAY

SCOPE OF THE PRIVACY POLICY

When does this Privacy Policy apply

This Privacy Policy governs Liferay’s processing of your Personal Data collected by Liferay through your use of a Liferay website or any portions thereof, mostly within the scope of your cooperation with Liferay, including through your use of Liferay Services either provided to you under a contract with you or under a contract with a third party, in preparation of such a contract or otherwise in connection with such a contract. Regarding your use of websites, this Privacy Policy applies to the www.liferay.com website and other websites which Liferay operates, and on which Liferay posts a direct link to this Privacy Policy. 

This Privacy Policy furthermore governs Liferay’s processing of your Personal Data, provided to Liferay by you or a by a third party on other occasions, for example when Liferay attends or sponsors third party events, when you access Liferay content published on third party websites or when you request information about or access to Liferay Services from Liferay’s business partners, to the extent Liferay (or a third party on behalf of Liferay) directly refers  to this Privacy Policy.

Other Statements, Policies and Notices

In order to ensure that you are fully aware of how and why we are using your Personal Data it is important that you read this Privacy Policy together with any other privacy notice, fair processing notice or statement Liferay may provide on specific occasions when we collect or process Personal Data about you (“Ad-hoc Notices”). This Privacy Policy supplements Ad-hoc Notices and is not intended to override them. Ad-hoc Notices prevail in any event of conflict. 

This Privacy Policy does not apply in the context of:

Certain FOSS Projects and Co-Branded Websites

Unless the respective websites include a direct link to this Privacy Policy, this Privacy Policy does not apply to open-source project websites sponsored by Liferay or to co-branded websites (websites where Liferay presents content together with one or more business partners). Such websites should have their own privacy statements, which Liferay encourages you to review for more information about applicable privacy practices. 

Liferay’s Enterprise Services

Liferay’s obligations with respect to Personal Data that Liferay may hold on behalf of customers, including Personal Data stored by its customers using Liferay’s cloud offerings or Personal Data stored in Customers’ databases that Liferay may access within the scope of a Professional Services or other assignments, are defined in the applicable agreements as between Liferay and the relevant customers, and Liferay’s processing of such data is not governed by this Privacy Policy. In this case, our customers’ privacy policies apply. 

Visits of Our Premises

This Privacy Policy does not apply to Liferay’s processing of your personal data collected by Liferay in connection with your visit to one of our offices. Such processing is governed by this notice: Trust Center

Employment and Your Applications

This Privacy Policy does not apply to our processing of your Personal Data processed by Liferay within the scope of your application for a job at Liferay and your employment. Such processing activities are governed by separate privacy notices, displayed in the application portal and on the intranet, respectively. If you are a prospective Liferay employee or contract worker, please refer to the privacy policy presented at the beginning of the job application process; you will be required to acknowledge that statement before submitting a job application containing personal information to Liferay via its agent, Jobvite. You can also find the privacy notice for job candidates here: Trust Center

External Services

Links to other websites

Our websites may contain links to other websites. For example certain Liferay FOSS offerings are available on GitHub and we also provide links to partners and clients on our website. Liferay does not disclose your Personal Data to the third parties maintaining its websites, but it also does not control and is not responsible for the information collected by websites that can be reached through links from Liferay’s websites. We cannot extend the statements regarding data protection to such websites. Nor does the fact that we refer to such websites mean that we adopt their contents as our own. If you use a link  to navigate to any of those sites, your information is governed by their respective privacy policies. We encourage you to review the privacy policies posted on such websites you visit. If you have questions about the data collection procedures of linked websites, please contact the organizations that operate those websites directly.

Frames

Some of our pages utilize framing techniques to serve content to/from third parties while preserving the look and feel of our site (such as YouTube). Such services may collect your Personal Data, if you decide to interact with them. To the extent that requires your consent, Liferay will obtain your consent.  However, Liferay does not control and is not responsible for the information collected by the embedded services that can be reached through links from Liferay’s websites. Therefore, when you decide to interact with these services, please be aware that you are providing your personal information to these third parties and not to Liferay.

Social Media Widgets

Liferay may provide social media features that enable you to share information with your social networks and interact with Liferay on various social media websites. Your use of these features may result in the collection by or sharing of information about you with such social networks or social media websites, depending on the feature. These features may collect your IP address, which page you are visiting on our website, and may set a cookie to enable the feature to function properly. Social media features are embedded in our website but are hosted by a third party. If you use a widget and navigate to any of those sites, your information will be governed by their respective privacy policies. We encourage you to review the privacy policies posted on such websites you visit.  If you have questions about the data collection procedures of linked websites, please contact the organizations that operate those websites directly. 

Single Sign On

You can log in to our website using single sign-on services (such as Google SignIn). These services will authenticate your identity and provide you the option to share certain Personal Data with us such as your name (first and last) and email address to pre-populate our sign up form. Some of these services give you the option to post information about your activities on this website to your profile page to share with others within your network.

DEFINITIONS

In this Privacy Policy we use some Privacy Terms, we would like to clarify. When we say

• “CCPA”, we mean the most prominent data protection law in the US, the Californian version. 
• “data protection  laws”, we mean GDPR, UK GDPR, LGPD, CCPA and any additional relevant national and supra-national laws that govern how we are required to proceed with your personal data.  
• “GDPR”, we mean this European data protection law. 
• “LGPD”, we mean the Brazilian data protection law. 
• “Liferay Affiliate”,  “we”, “ours” or “us”, we refer to the Liferay Affiliate as further defined in Section and specifically identified as “Responsible Liferay Affiliate” in Section “Data Controller and Contact Information”  below. 
• “Personal Data” is all data about or related to you, which enables us to identify you, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity. Where we use the term “Personal Data”in context of our activities that involve California residents, the term shall include “Personal Information” as the term is defined in the CCPA.
• “process” or “processing”, “treat” or “treatment”, we refer to everything that we do with your personal data, from collecting it to its use and disposal. 
• “UK GDPR”, we mean the UK law, currently GDPR “frozen” as of the end of December 2021 (upon Brexit). Since GDPR hasn't changed since Brexit and the UK didn't change the UK GDPR yet, essentially the UK GDPR is the same as GDPR for now. 
• “you” or “your”, we refer to all individuals whose Personal Data Liferay processes in accordance with this Privacy Policy as outlined in Sec “Scope of this Privacy Policy”.

To the extent we refer to specific terms of GDPR, such references include corresponding terms under other applicable data protection laws, such as for example, but without limiting generality of the foregoing, the UK GDPR, the Brazilian LGPD, etc.

DATA CONTROLLER AND CONTACT INFORMATION   

Liferay is a global group of companies operating through separate legal entities such as Liferay, Inc., Liferay International Limited and its respective subsidiaries or other affiliated companies that control, are controlled by or are under common control with Liferay International Limited, such as for example Liferay Latin America Ltda. (each entity separately referred to as a “Liferay Affiliate” and collectively the Liferay group of entities as “Liferay”). 

Liferay Affiliates provide software and other related technology services (“Services”). While it is Liferay’s desire to provide its Services locally where its customers and/or users are located in accordance with the relevant laws of the jurisdictions in which the different Liferay Affiliates respectively operate, as much as possible, some Services are sold or offered only through a single Liferay Affiliate globally. In order to operate efficiently as a global group of companies, Liferay Affiliates share resources within the global Liferay group. These resources include common websites, operated by Liferay, Inc., and certain services within the scope of this Privacy Policy. 

The Liferay Affiliate primarily responsible for compliance with the data protection laws, when processing your Personal Data, is the “Controller” as the term is defined in GDPR.

If the processing of your Personal Data is in fulfillment of or otherwise in connection with an existing contract between you or a legal entity you represent and a Liferay Affiliate, the responsible controller of your Personal Data will be the Liferay Affiliate that is the actual party to the contract with you or the legal entity you represent, as indicated in the applicable contract. You can find contact details of the controlling Liferay Affiliate in the “Notices” section of the relevant contract with Liferay.

If the processing of your Personal Data is in preparation of an anticipated contract between you or a legal entity you represent and a Liferay Affiliate, or in preparation, fulfillment or otherwise in connection with a contract between you or a legal entity you represent and a Liferay Affiliate,  you can identify the controlling Liferay Affiliate for any processing that is in connection with any of such activities by the specific Service provided by a single Liferay Affiliate globally or by the region, in which the legal entity you represent is located, as indicated in the table below, for the Liferay product or service you are interested in. 

Liferay appointed several Data Protection Officers (“DPO”) and representatives (“Representative”), where required in accordance with the applicable laws, as identified in the table below.  

In addition, Liferay has established a global Privacy Office responsible for overseeing all  privacy related questions  at Liferay. You can reach our Privacy Office at: [email protected] 

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, you can contact the Privacy Office, DPO or a Representative as applicable. Furthermore, you can contact the Responsible Liferay Affiliate who as such is responsible for your Personal Data.

 
Where a registration form is presented on this website, the data controller may vary depending on the actual offering or the purpose of the data collection. If this is the case the differing data controller will be displayed on the individual registration form’s Ad-hoc Privacy Notice.

YOUR PERSONAL DATA 

Liferay collects Personal Data directly from you when you interact with us, including, without limitation, when you:

• Navigate (from emails or other websites) to or through our website;
• Create a user account (individual or corporate);
• Make online purchases or register products;
• Request a demo, contract or support;
• Register for a Liferay webcast, webinar or other on-line or on-site event;
• Register for newsletters;
• Request information or materials (such as whitepapers, case studies and alike);
• Participate in surveys, evaluations or provide testimonials;
• Participate in promotions, contests, or giveaways;
• Submit questions or comments; 
• Submit content or posts on Liferay’s customer portal pages or other interactive webpages;
• Communicate with Liferay through other technical means, such as social media or other interactive media;
• Share your contact details with us within a context a Liferay or third-party events (directly or indirectly); or
• When you engage in further interactions with us (directly or indirectly) not particularly listed above and we refer you to this policy.

To the extent permitted by applicable law, and, where required, as authorized by you, the types of Personal Data collected directly from you may include, without limitation: 

• Information used to communicate with you and the content of such communication, such as name, title, company name, email address, telephone number, postal address and language, our exchanged emails, chat messages, notes summarizing our calls (or transcripts and recordings of such conversations) including meta-data and live conversations;
• Information that Liferay maintains in association with your individual or corporate account, such as your username, password, payment information, purchase records, credit and billing status, your comments and other records of your activities including your product usage information and support inquiries, information associated with the company you represent that you either directly share with us or we receive from registries and publicly accessible services; or
• Information associated with the purchases of Liferay Products and Services on behalf of a legal entity you are representing, including pre-contractual, contractual and post-contractual requests and exchanges, communication, the purchasing history, payment information, product usage information and support inquiries;
• Images that identify you and your statements to the extent you decide to share them with us or allow us to record them and use for our commercial purposes or even publish, including the images and statements you decide to post using your profile at our websites or testimonials, survey replies or your feedback that you decide to provide to us;
• Other information you share via your publicly accessible information related to your professional position;
• Certain online identifiers such as your IP or other system generated IDs such as cookie ID, information that can be derived from such identifiers, such as geographic location, information about the device your use such as browser, operating system and device type, and other tracking information associated with such identifiers (including your navigation through and interactions with our websites or emails, advertisements or items of content and areas of the sites views and clicks, your preferred language, items stored in your shopping cart);

Liferay may also collect information relating to your navigation to and at our websites, your experience with our websites and your interactions with our materials, offerings and emails through the use of various technologies. Collecting information in this manner allows us to analyze the effectiveness of our websites and our marketing efforts, understand your needs and areas of interest,  personalize your experience and improve our interactions with you. For more information about the technologies Liferay employs for these purposes, see the “Cookies and Other Technologies” section below. 

In addition, Liferay may receive and supplement the Personal Data it collects from you with Personal Data or other information about your professional and company profile from third parties, such as from the company you represent, our customers and prospects, our business partners, publishers featuring our content, organizers of sponsored or collaborative events, and registries. Liferay does this to help us improve the overall accuracy of the information and its completeness and to help us better tailor and channel our interactions with you. Prior to receiving your data from any third parties, we will ensure that the data is collected and shared with us in compliance with the applicable legal requirements. We will inform you about our processing of your data at the time we start processing it or at the latest when we first reach out to you. 

HOW AND ON WHAT LEGAL BASE LIFERAY PROCESSES YOUR PERSONAL DATA

Liferay will process the Personal Data provided hereunder only as set out in this Privacy Policy. 

Liferay primarily uses Personal Data in an effort to enable your use of the website, its contents and other Services, to interact with you and to enhance your experience on our websites and other Services. We will only use your Personal Data in the way specified when it was collected and for compatible purposes. Subsequently, we will not change the way your Personal Data is used without your consent. In particular, Liferay uses Personal Data it collects about you as explained in more detail below. 

How Liferay uses your Personal Data in connection with a contract 

Liferay processes your Personal Data without your consent in accordance with applicable data protection laws to:

Identify and Authenticate You

Liferay uses your Personal Data to verify your identity when you access and use certain Liferay’s services and to ensure the security of your Personal Data and security of our Services to protect personal data and other confidential information of other users. This includes your creation of an account that is associated with your Personal Data. Some features on the Liferay website are available to users only upon registration. Liferay uses Personal Information in order to allow individuals to access the Liferay community resources such as forums, wiki and the issue tracker. The Personal Data that may be collected and processed for this purpose includes (all or a subset of): name, job role, title, company name, email address, telephone number, postal address, language, username, password. Liferay processes this information on the basis of contractual necessity. 

Fulfill Your Requests

If you request something from Liferay, such as a product or service, a call back, a newsletter subscription, participation in contests or sweepstakes or specific marketing or other materials, or certain Services Liferay uses the Personal Data you provide (usually via a registration form, order or an action in response to such request) to respond to and to fulfill your request. The Personal Data that may be collected and processed for this purpose includes (all or a subset of) name, job role, title, company name, email address, telephone number, postal address, language, username, support inquiries, purchase records and if payment is to be made to Liferay payment information, credit and billing status, your public user profile your create, your comments or other content linked to this user account. Liferay processes this information in order to comply with Liferay’s contractual obligations to you when responding to your requests. This may include taking the necessary steps prior to entering into the contract, responding to your related inquiries, and providing you with shipping and billing information, to process or provide customer feedback and support or to publish your Personal Data, such as training certificate validation information. This may also include conversation data that you may trigger via the chat functionalities on liferay.com or other local Liferay web presences, contact forms, emails, telephone or through functionalities of our interactive websites. Liferay processes this information on the basis of contractual necessity. 

Creating and operating user profiles

Liferay offers you the option to use certain interactive web-based offerings such as blogs, forums and networks (such as the Liferay Community) associated with Liferay’s FOSS offerings that require you to register and create a user profile. User profiles provide the option to display your Personal Data to other users, including your name, image, social media accounts, postal and email address, phone number, professional interests, skills, and basic information about your educational and professional background. While most of these entries are optional, we encourage users to provide at least some information to be accepted as an active part of Liferay Community. These interactive offerings are designed to foster your exchange with other members of Liferay Community, online and offline.  Online interactions are usually conducted through the messaging function, blogging and posting in forums and wikis.  You have full control of the Personal Data you enter and display in your user profile. We create these profiles and display any of your Personal Data you choose, in response to your request to fulfill our contractual obligations towards you as a Community member.

Provide Support and Customer Service

Liferay uses your Personal Data to provide support for Services you have obtained from us and answer other questions. The Personal Data that may be collected and processed for this purpose includes (all or a subset of) name, job role, title, company name, email address, telephone number, postal address, language, username, support inquiries, purchase records and if payment is to be made to Liferay payment information, credit and billing status. Liferay processes this information in order to comply with Liferay’s contractual obligations to you. Otherwise, we do that since it is in Liferay’s legitimate interest to use your Personal Data in such a way to ensure that we provide the very best customer service we can to you or others. Please note, that in the course of providing technical support to you, Liferay may sometimes have incidental access to data that you have provided to us or data that is located on your systems. This data may contain information about you, or your organization’s business, employees, customers, partners, or suppliers. This Privacy Policy does not govern Liferay’s access to or handling of such information. The conditions regarding the handling and processing of that data is covered by the applicable agreement between the customer on whose behalf you cooperate with Liferay and Liferay, such as Liferay’s Enterprise Services Agreement. 

To perform other processing activities required as part of the business relationship

If you participate in training provided by Liferay, Liferay tracks your learning progress in order to enable resuming of the training at a later point of time and also to document your completion of the course. The latter will be particularly relevant if you apply for a Liferay Certification program, available to you. If you register for an exam session in order to obtain a Liferay Certification, we will need to check your identity when you apply for the exam and during the exam: this can either be done by acquiring a copy of your identity document (to the extent this is permitted under the applicable national laws) or otherwise by checking your identity document via webcam during the exam. In addition, we may check that your exam is being done correctly by watching you via webcam. In case you pass the Liferay Certification exam, we will store the result in our database and show it on a public website in order to allow for everyone to verify your credentials. Furthermore, we communicate on a regular basis by email with users who subscribe to our Services, and we may also communicate by phone to resolve customer complaints or investigate suspicious transactions. We may use your email address to confirm your opening of an account, to send you notice of payments, to send you information about changes to our products and services, and to send notices and other disclosures as required by law. Generally, users cannot opt out of these communications, which are not marketing-related but merely required based on law of contract for the relevant business relationship, unless there are valid reasons that you can share with us. We will rely on contractual necessity.

How Liferay uses your Personal Data for compliance purposes

To ensure compliance

Liferay is committed to compliance with all applicable laws and regulations. Therefore, under certain circumstances, we might use your data to ensure our compliance with the relevant laws.

Export Control

Liferay and its technologies, products and services are subject to export control laws and regulations of certain countries including, without limitation, laws and regulations of the United States of America and the European Union and its member states. You acknowledge that, pursuant to these applicable laws and any associated trade sanctions or embargoes issued by these countries, Liferay must take measures to prevent entities, organizations, and parties listed on government-issued sanctioned-party lists from accessing certain products, technologies, and services through Liferay’s websites or other delivery channels controlled by Liferay. This may include (i) automated checks of any user registration data as set out herein, other information a user provides about his or her identity and the information our websites and services might automatically capture (such as your IP-address) against applicable sanctioned-party lists; (ii) regular repetition of such checks whenever a sanctioned-party list is updated or when a user updates his or her information; (iii) blocking of access to Liferay’s services and systems in case of a potential match; and (iv) contacting a user to confirm his or her identity in case of a potential match.

Anti-Corruption and Anti-Money Laundering

Liferay is subject to Anti-Corruption and Anti-Money Laundering laws in the jurisdictions in which Liferay Affiliates are located. Therefore, to the extent you request Liferay Services, show interest in a partnership or another collaboration with Liferay, Liferay might use your data to identify the need for a due diligence review and to conduct such reviews to the extent this is required under the relevant laws. This may include (i) checks of any user registration data provided by the user, the information our websites and services might automatically capture (such as your IP-address) in combination with the financial information we receive from you and information we receive from other sources (such as registries); (ii) regular repetition of such checks as required; (iii) contacting a user for further clarification in case of an identified concern; or (iv) blocking of access to Liferay’s Services, systems or programs in case Liferay determines collaboration with a user or company the user represents constitutes an unacceptable risk of non-compliance to Liferay.

Your Content

For the purposes of interactive websites, Liferay is furthermore subject to laws that require Liferay to ensure the content posted by the users does not violate any laws or third-party rights. Therefore, Liferay might - due to legal requirements - need to review and suspend or remove some of your content posted at Liferay’s websites or to share some information about you and your content with third parties whose rights are allegedly violated by you. Liferay will notify you separately, in case this should be required.  

Cooperation with authorities

If Liferay should be legally obligated to do so, upon request, Liferay might provide information about you or the company you represent to enforcement or supervisory authorities. The scope of the affected data will depend on the individual case. However, Liferay will carefully assess each such request to establish that the request is binding to Liferay, lawful and make sure Liferay only provides the minimum information required to comply with such request. 

Security

Liferay will process certain information, including your Personal Data, such as email address, the body of your emails and meta-data submitted with your emails, IP and other online identifiers, suspicious log-in attempts or other suspicious activities, by automated means (including using anti-virus programs, and other products and services) to ensure security and integrity of its Services, systems and personal data of its employees, prospects and customers and other individuals as required under the applicable data protection laws. Such activities might include prevention of or defense against DDOS attacks and interception of communication between and with our systems, products and Services, prevention of unauthorized access to our Services or data scraping and other intrusive activities that might jeopardize integrity of our systems, Services and data.

Data Protection

Furthermore, Liferay processes any information required to track your choices regarding the processing or use of your Personal Data or receipt of marketing materials, as well as to document our compliance with your opt-out (that is to say, depending on the country in which the relevant Liferay group company operates, whether you have expressly consented to or opted out of receiving marketing materials) and other requests made with regard to your Personal Data (Data Subject Requests), as well as any information regarding eventual data breaches or any privacy related disputes may be stored and exchanged between members of the Liferay company group as required to ensure, document and proof compliance.

How Liferay uses your Personal Data to pursue Liferay’s legitimate interests, unless your consent is required 

In addition to certain cases in which Liferay fulfills your requests as outlined above, Liferay also processes or uses your Personal Data as necessary to pursue following purposes. We rely on our legitimate interest, unless consent is required in which case we obtain and rely on your consent and process your data as further described in Section “How Liferay uses your Personal Data based on your consent” below.

Creation of aggregated or demographic data sets

In using our products or services, certain network information may be transmitted back to us to determine how users are interacting with our products, assist us with improving our products, offerings and operations, and provide alerts regarding available software updates/upgrades.  In some instances, Liferay may collect aggregate or demographic data through cookies, web logs, and web beacons. That information is used to improve the usability, performance, and effectiveness of the website. Please read the "Cookies" section below for more information.

Improve accuracy and completeness of data for targeting

Liferay may receive and supplement the Personal Data it collects from you with Personal Data or other information about your professional and company profile from third parties, such as from the company you represent, our customers and prospects, our business partners, publishers featuring our content, organizers of sponsored or collaborative events, and registries. Liferay does this to help us improve the overall accuracy of the information and its completeness and to help us better tailor and channel our interactions with you. Prior to receiving your data from any third parties, we will ensure that the data is collected and shared with us in compliance with the applicable legal requirements. We will inform you about our processing of your data at the time we start processing it or at the latest when we first reach out to you. 

Security of our systems, data and content

Liferay may furthermore employ some additional techniques and tools, not strictly required under the applicable data protection or other laws, but already known as best practices, to add a layer of security to Liferay’s products, services, data, content and systems. For example, Liferay may from time to time consult certain registries and databases that might incidentally include your personal data for the purposes of early detection of potential data leaks. Liferay will not retain any incidentally detected Personal Data, unless required for enforcement of Liferay’s claims as further explained below or for evidentiary purposes. 

Enforcement of claims/retention 

Liferay may maintain and use some or all of your Personal Data as might be required to defend Liferay against Claims. The scope of the Personal Data in question will depend on the context of your interactions with Liferay.  For example, if you were involved in the purchase of Liferay products and/or Services, either on your own or a legal entities’ behalf, Liferay may maintain records of your conversations with Liferay prior to purchase of the services or data that was created through your use of the services, for the duration of the statutory term under the applicable contract, and use the data to defend itself against your claims or the claims of the company you represent. If you publish content at one of Liferay’s websites that violates third party rights or other laws and regulations, Liferay may use the records of your activity to defend itself against claims by third parties. In addition, Liferay may deploy techniques which might process some of your Personal Data (such as IP and other online identifiers) or obtain your Personal Data from third party sources such as ISPs (including your IP, name and address) to enforce its rights in Liferay’s property (including Intellectual Property). 

Creditworthiness

Liferay may furthermore use the information you submit, in combination with your Personal Data and, if applicable, any information about the legal entity you claim to represent, to check your creditworthiness or creditworthiness of the legal entity you represent, as applicable. 

Audits

Liferay maintains several compliance programs and conducts regular internal audits of its online activities. In addition, Liferay might be subject to an external audit by external auditors or certification bodies acting on Liferay’s behalf). In the course of such audits, Liferay might process some of your Personal Data to assess Liferay’s compliance or share some of your personal data to evidence its compliance with the applicable legal requirements. 

Right to object

If you do not agree with this approach  on grounds relating to your particular situation, you may object to Liferay’s processing or use of your Personal Data via email at [email protected] and Liferay will cease using your Personal Data for the purposes below (that is to say, under a legitimate interest set out below) and remove it from its systems, unless Liferay is permitted to use such Personal Data for another purpose set out in this Privacy Policy or Liferay determines and demonstrates a compelling legitimate interest to continue processing your Personal Data for the purposes identified above.

Communication on the basis of legitimate interest, unless your consent is required

In addition to the cases outlined above, Liferay also processes or uses your Personal Data for communication with you. We rely on legitimate interest for the activities outlined in this Section below, unless consent is required under the relevant laws, in which case we obtain and rely on your consent to process your Personal Data as further described in Section “How Liferay uses your Personal Data based on your consent” further below. 

Keep you up-to-date/request feedback

Within an existing business relationship between you or the company you represent and Liferay, Liferay will inform you, where permitted in accordance with local laws, about its products or services (including webinars, seminars or events) which are similar or relate to such products and services you have or the company you represent has already purchased or used from Liferay. Furthermore, where you have or the company you represent has attended a webinar, seminar or event of Liferay or purchased products or services from Liferay, Liferay may contact you for feedback regarding the improvement of the relevant webinar, seminar, event, product or Service.

Marketing Communication 

Liferay may use your data to communicate with you and Provide you with Information about Liferay products, services and events. Liferay may use your Personal Data to notify you about product and service offerings as well as events that Liferay believes may be of interest to you. Liferay also may use your Personal Data to respond directly to your requests for information, including registrations for newsletters or other specific requests. The Personal Data that may be collected and processed for this purpose includes: name, title, company name, email address, telephone number, postal address, language, username, payment information, purchase records, credit and billing status, support inquiries and some tracking information including certain online identifiers such as IP or other system generated identifiers (as further outlined in Section “Cookies and other Technologies below”). Liferay may furthermore utilize web-bacons or pixels or any other similar technologies like tags to capture your interactions with our website and marketing communication. With regard to marketing-related types of communication (i.e. emails and phone calls), Liferay will provide you the opportunity to opt out if you do not want to receive further marketing-related types of communication from us; You can opt out of our marketing communication at any time by either using opt-out functionality accessible through the messages you receive or via email to [email protected]. It is in Liferay’s legitimate business interests to be able to provide customers, prospective customers, and the public with information about Liferay’s products, services, and events. 

Questionnaires and surveys

Liferay may invite you to participate in questionnaires and surveys. These questionnaires and surveys will be generally designed in a way that they can be answered without any Personal Data. If you nonetheless enter Personal Data in a questionnaire or survey, Liferay may use such Personal Data to improve its products and services.

Enabling Exchange

If you register for a seminar, webinar or other event of Liferay, Liferay may share basic participant information (your name, company, and email address) with other participants of the same seminar, webinar or other event for the purpose of communication and the exchange of ideas.

Right to object

You may object to Liferay using Personal Data for the above Communication purposes at any time at no cost by unsubscribing at [email protected]. If you do so, Liferay will cease using your Personal Data for the above purposes (under a legitimate interest set out above) and remove it from its systems (unless Liferay is permitted to use such Personal Data for another purpose set out in this Privacy Policy ).

How Liferay uses your Personal Data based on your consent we obtain

To the extent your consent is required under the applicable laws, we obtain your consent for the specific activities and rely on your consent for the purposes outlined below. You can find an overview of possible consent statements and the corresponding processing activities covered by these consents statements here. Please note that if you visit this Privacy Policy after you have given your consent(s) once or more you will always see the full Privacy Policy and not just the statement related to your specific consent as it appeared in the Ad-hoc Privacy Policy or statement presented to you at the time of collection of your Personal Data.  

Special Categories of Personal Data

As part of your registration for and in the context of granting you access to a seminar, conference or other event, Liferay may ask for information that might reveal some information related to your health or religious beliefs only for the purpose of identifying and being considerate of individuals who have disabilities or special dietary requirements throughout the event. This information will only be used to the extent you have consented to such use, only for the purposes identified above. Please note that if you choose to not provide such information about disabilities or special dietary requirements or do not consent to Liferay using such information for the specified purpose, Liferay will not be able to take any respective precautions to address any such needs.

Recording or transcribing of calls for documentation and quality improvement purposes 

In case of video conferences/video calls Liferay may record or use AI driven technologies to transcribe such calls (after informing you accordingly during that call and before the recording starts) or chat sessions in order to maintain documentation of the conversation, and, in some cases, to improve the quality of Liferay’s services.

Testimonials

We sometimes request consent from our customers to use their statements about Liferay and their experience with Liferay’s product and services for advertising purposes. We often publish such testimonials on our websites and share them on social media and in the press. 

Request feedback

Sometimes, where you have or the company you represent has attended a webinar, seminar or event of Liferay or purchased products or services from Liferay, Liferay may contact you for feedback regarding the improvement of the relevant webinar, seminar, event, product or Service.

Marketing Communication

Liferay may use your data to communicate with you and provide you with Information about Liferay products, services and events. Liferay may use your Personal Data to notify you about product and service offerings as well as events that Liferay believes may be of interest to you. Liferay also may use your Personal Data to respond directly to your requests for information, including registrations for newsletters or other specific requests. The Personal Data that may be collected and processed for this purpose includes: name, title, company name, email address, telephone number, postal address, language, username, payment information, purchase records, credit and billing status, support inquiries and some tracking information including certain online identifiers such as IP or other system generated identifiers (as further outlined in Section “Cookies and other Technologies below”). Liferay may furthermore utilize web-bacons, pixels or any other similar technologies like tags to capture your interactions with our marketing communication. With regard to marketing-related types of communication (i.e. emails and phone calls), Liferay will (where legally required) only provide you with such information after you (i) have consented to the receipt of marketing communication and (ii) provide you the opportunity to opt out if you do not want to receive further marketing-related types of communication from us; You can opt out of our marketing communication at any time by either using opt-out functionality accessible through the messages you receive or at [email protected]. 

Questionnaires and surveys

Liferay may invite you to participate in questionnaires and surveys. These questionnaires and surveys will be generally designed in a way that they can be answered without any Personal Data. If you nonetheless enter Personal Data in a questionnaire or survey, Liferay may use such Personal Data to improve its products and services.

Enabling Exchange

If you register for a seminar, webinar or other event of Liferay, Liferay may share basic participant information (your name, company, and email address) with other participants of the same seminar, webinar or other event for the purpose of communication and the exchange of ideas, with your consent. Otherwise Liferay will only share information that will not allow recipients to identify you, such as the information about the company you represent (company name, region/country and industry of location) and the category of your profession (technical, business, etc.).

Withdrawal of a consent granted hereunder

You may at any time and at no cost withdraw your consent provided to Liferay for any of the purposes above either using the “opt-out” functionality provided with each message you receive from Liferay or otherwise via an email to [email protected]. If you withdraw your consent, Liferay will cease using your Personal Data for the above purposes (under a consent set out above). However, note that Liferay will still be required to retain some of your Personal Data to ensure compliance with your choice to not receive any marketing communication from Liferay anymore (we will keep your email address in our "suppression list”) and to maintain evidence. Otherwise, your Personal Data will be restricted from further processing and only retained for the term required by law. Please note that your withdrawal will only have an effect for the future but no effect on processing of Personal Data by Liferay prior to your withdrawal. 

Generally, you provide your Personal Data and consent to the use of your Personal Data as described in this Section by Liferay entirely voluntarily. You will not face any detrimental effects if you don’t. However, this can impact Liferay’s ability to offer your certain web services or notify you of new offerings or invite you to Liferay events. In this case, if you would still prefer to use any of these services, this will require a new consent.

COOKIES AND SIMILAR OR RELATED TECHNOLOGIES

Liferay and its third-party service providers utilize technologies such as cookies and similar on our website, including web beacons, embedded web links, local storage objects, and other commonly used information-gathering tools. 

These tools help to distinguish you from other visitors of Liferay websites. They automatically collect certain standard information that your browser sends to the Liferay website such as your IP, browser type and language, operating system, location, date and time. Using these tools, Liferay can also track other information such as pages or items of content navigated to on the relevant Liferay website and certain other aggregate data that is not related to a particular individual.

Cookies

Liferay may use cookies to collect information as you navigate Liferay’s websites. A cookie is a small amount of data that is sent to your browser from a web server and stored on your device.

Cookie Policy

​​​​​​We scan our website with industry-standard cookie scanning tools regularly with the goal of maintaining an accurate and detailed list of the cookies we use on the website. You can find the list of the cookies we use on our website and a description of the cookie, their category, description and the lifespan in our Cookie Policy.  

We classify these cookies we use in four categories: Personalization Cookies, Functional Cookies, Performance Cookies and Strictly Necessary Cookies. You will find a detailed description of these categories below. 

Categories of Cookies Liferay uses

Strictly Necessary Cookies 

These cookies are necessary for the website to function and cannot be switched off in our systems. The main reason why these cookies cannot be switched off is that they are strictly necessary for the delivery of services on Liferay’s websites. They are usually only set in response to actions made by you which amount to a request for services, such as navigating to the website, setting your cookie preferences, logging in your user account or filling in forms. For example, the Strictly Necessary Cookies allow Liferay to record your choices, to route your requests and manage your session, to load the website and content, to ensure the safety and security of its websites, services and offerings, systems and other users’ Personal Data, to authenticate registered users to allow access to their accounts on Liferay’s websites, to allow access to certain restricted portions of Liferay’s websites with the use of only one login, to balance the traffic on Liferay’s websites, and, for example, if you decide to add items into your shopping cart. Cookies that are strictly necessary are not used for marketing purposes. If you prevent these cookies, Liferay may not be able to ensure that and how the website or the security on the website will perform during your visit. You can set your browser to block or alert you about these cookies, but if you block them, some parts of the site might cease to work. 

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site, whether visitors of our websites experience any technical issues during their visits to our websites and overall help us improve our websites, their performance, design and the contents we offer and measure the effectiveness of our online advertising. All information these cookies collect is aggregated and therefore anonymous. This information does not allow us to identify you. While some of these cookies are being set by third parties, Liferay does not allow such third parties to use the information for any other purposes. If you disable these cookies, Liferay will not be able to monitor performance of the websites.  

Functional Cookies

These cookies enable the website to provide enhanced functionality and personalization, as they provide us with a better understanding of your interests and requirements regarding Liferay’s websites, Liferay’s operations or its products and services. For example, these cookies may be used to invite you to participate in surveys, allow you to remain logged-in for an extended period of time, help us provide you with support services, remember your login information and language preferences if you chose, and may help prepopulate forms that you have already completed. They may be set by us or by third party providers whose services we have added to our pages, for example such as JobVite or ZenDesk. If you do not allow these cookies then some or all of these services may not function properly.

Personalisation Cookies

These cookies may be set through our site by our advertising/social media partners. They do not store directly personal information but are based on uniquely identifying your browser and internet device to offer you to share content on social media or to show you relevant content or ads on our website or other platforms. They may also be used by those companies to build a profile of your interests and show you relevant advertisements on other sites. We may receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis. For more information about the use of these technologies by our third-party service providers and how they use your information, please refer to their respective terms and conditions and privacy notices.

Liferay utilizes Google Analytics and Google advertising products on its websites. The relevant disclosures for Google Analytics and advertising products are available here:
https://policies.google.com/technologies/partner-sites 
https://support.google.com/analytics/answer/6004245 

Your Choices

You can control the use of cookies at the individual browser level. You can configure your browser so that it always rejects cookies or asks you each time whether you want to accept them or not and delete already placed cookies through your browser settings (typically in the “Privacy and Security” section). 

Our use of Strictly Necessary Cookies generally does not require your consent. For all other cookies Liferay provides you with choices through the cookie banner when you navigate to our website. 

We will ask for your consent before we place any Performance, Functional or Personalization Cookies on your device, where this is required under applicable laws (for example, if you are located in the EU or UK).  If you choose to “reject all”, no cookies except Strictly Necessary Cookies will be placed. If you accept all, the cookies of all categories will be placed. Alternatively, you’ll be able to change your cookie preference settings more granularly. 

If you are located in a country or region that does not require consent for cookie placement, you will be able to opt-out of each cookie category (except for Strictly Necessary Cookies) by clicking on the “Manage Cookie Settings” button displayed in the cookie banner that appears when you navigate to our website.

If you are a resident of California, you will be able to “opt-out-of-sale” of your Personal Data, by clicking on the “Manage Cookie Settings” button displayed in the cookie banner that appears when you navigate to our website.

In addition, if you decide to withdraw your previously provided consent or to opt-out at a later point of time, you can change your cookie preferences at any time  by clicking on the “Cookie Settings” button at the top of the Cookie Policy and indicating your preferences.
However, please note that blocking or deleting cookies may impact the performance and reduce functionality available to you of Liferay websites. 

Similar or Related Technologies

Liferay might furthermore employ some or all of the similar or related technologies, as further described above. The main purpose of these technologies is to gain insights and improve performance of the website and our marketing. We rely on consent (where required by law, like for example in the EU and UK), or otherwise on legitimate interest. You will be able to exercise choices (including opt-in, opt-out or opt-out-of-sale, depending on the requirements in the country of your location) through the interface of the cookie banner that appears when you navigate to our websites and later through the “Manage Cookie Settings” which you can access at all times by clicking the button displayed at the top of the Cookie Policy.  To the extent we are not able to implement such technologies in a manner that allows management of these technologies through the “cookie settings” of our cookie banner, we ensure that these technologies only capture and Liferay only uses other than Personal Data. To the extent such technologies relate to our marketing communication, you can opt-out of tracking such communication via email to [email protected].  

Local Storage Objects

Liferay uses Local Storage (LS) such as HTML5 to store content information and preferences. Third parties with whom we partner to provide certain features on our site or to display advertising based upon your Web browsing activity use LS such as HTML 5 to collect and store information.

Web Beacons, Pixels and Tags

Liferay may employ web beacons, pixels, or tags, alone or with cookies, to track website usage and email engagement (like open and click-through rates for its emails and websites). Web Beacons and Pixels tiny electronic images that can identify certain device information, including cookies placed by the website you viewed, and the websites associated with the beacon. Tags are small segments of code that are executed when loading a website. Typically, they are HTML or JavaScript that describe an element or function of Liferay’s website. Cookies and pixels are usually set by tags. Where required, we obtain your consent (particularly in the EU and UK), and otherwise on legitimate interest to gain insights or improve our interactions with you.

Behavioral Targeting/Re-Targeting

We partner with a third-party ad network to either display advertising on our website or to manage our advertising on other websites. Our ad network partner uses cookies and web beacons to collect information about your activities on this website and other websites to provide you targeted advertising based upon your interests. If you wish to not have this information used for the purpose of serving you targeted ads, you may opt-out by clicking here (or if located in the European Union click here). Please note this does not opt you out of being served advertising in general. You will continue to receive generic ads.

Analytics/ Log Files

As is true of most websites, we gather certain information automatically and store it in log files. This information includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system, date/time stamp, and clickstream data. We do this based on legitimate interest, to administer our website, ensure it operates as intended, analyze errors, to improve our site’s availability, security and functionality and to gather trends, generate site performance analytics and demographic information.

HOW LIFERAY DISCLOSES YOUR PERSONAL DATA

Liferay will generally not sell, rent or lease your Personal Data to others without your consent, except as outlined in the Section “Cookies and other Automated Tools”, and as identified in this Section:

Based on your request

In some cases, we will disclose your data to third parties and potentially even broader public, in response to your action that amounts to a Service request where the Service itself in its core entails disclosure of your Personal Data:

Public forums and profiles

Liferay websites may make chat rooms, forums, blogs, message boards, and/or news groups available to its users. 
The profile you create on our site will be publicly accessible unless otherwise indicated. You may change the privacy settings of your profile through your account portal.

If you believe that an unauthorized profile has been created about you or for you and you would like us to remove it for other reasons, you can request for it to be removed by contacting us at [email protected].  

Liferay Community

For example, if you participate or contribute to Liferay's forums, wikis, documentation-related pages, and other pages within the Liferay website (Community), the information you provide there (including your first and last name and eventually your image) will be made broadly available to others, potentially inside or outside Liferay. Also, please recognize that certain forums may have additional rules and conditions. Each participant's opinion within a forum or chat room is his or her own and does not reflect the opinion of Liferay. Remember that your comments and posts become publicly available, and Liferay urges you to exercise discretion when submitting such content. 

To request removal of your Personal Data from our blog or community forum, contact us at [email protected]. In some cases, we may not be able to remove your Personal Data, in which case we will let you know if we are unable to do so and why.

Based on your consent

Testimonials

We display testimonials of customers on our site in addition to other endorsements. Such testimonials may include personal quotes along with the person's name. If you wish to update or delete a testimonial or your personal quote, you can contact us at [email protected].

Other cases

In addition, Liferay discloses or may disclose your Personal Data in the following ways:

Parties that support Liferay operations

As part of a global group of companies, Liferay has Affiliates and third party business partners and service providers globally and may disclose Personal Data to such Liferay Affiliates,  business partners and service providers in order to support Liferay’s business operations, such as (but not limited to) fulfilling your orders, following up on requests, providing support or customer service, and assisting Liferay with sales, marketing and communication initiatives, advising or defending Liferay against claims. Business partners and service providers include payment processors, financial service providers and institutions, professional advisors, materials production and shipping companies, postal services or governmental authorities such as customs, market intelligence and consulting service providers, and information technology service providers. Liferay Affiliates and service providers are data processors acting on behalf of Liferay and are required by contract (data processing agreement, where required) and business partners are required by virtue of law to keep the information confidential and secure and not use it for any purpose other than the purpose for which it was provided to them.

Investigations and Proceedings

Liferay may disclose Personal Data as required by law or legal process, such as responding to a duly authorized and lawful request of a police or public authority (including to meet national security or law enforcement requirements), in response to a court order,  to enforce or protect the rights of Liferay, when such disclosure is necessary or appropriate to prevent physical harm or financial loss as permitted by applicable law, or in connection with an investigation of suspected or actual illegal activity or enforcement activity by competent authorities.

CROSS-BORDER DATA TRANSFERS AND DATA PRIVACY FRAMEWORKS

Liferay is part of an international group of companies. Liferay companies therefore use shared systems and services and operate in a matrix-organization leveraging human resources of all Liferay Affiliates for our global operations. 

When Liferay enables communication for you with Liferay, your use of certain products and Services, the Responsible Liferay Affiliate transmits to or enables access to your Personal Data for such other Liferay Affiliates and service providers providing cloud based and other services to Liferay. Such “sharing” of personal data is called a “transfer” under some data protection laws. When the other Liferay companies are located in another country, and your data virtually “crosses the borders”, this is called a “cross-border data transfer”. 

Since Liferay companies are located in many countries globally, as you understand, such cross-border transfers of your personal data are happening at Liferay very often. A full list of all Liferay locations can be found here: https://www.liferay.com/locations. If your data leaves the country of your location, it travels to the locations of the other Liferay Affiliates which support the activity of the Responsible Liferay Affiliate, and otherwise to the service provider for the cloud based and other services we use, to one of our offices in the US and in the EU.

If you are located in the EEA, UK or Switzerland

General conditions of cross-border transfers

If you are based in the EU, then GDPR requires Liferay to make sure that it only transfers your Personal Data to other countries if Liferay can ensure that it will be properly protected in the recipient country, too.  Same applies to you, if you are based in the UK, under the UK GDPR.  

GDPR allows free flows of your Personal Data to the recipients based in the EEA (EU, Iceland, Liechtenstein and Norway). 

In addition, your Personal Data can flow freely to some other countries. For such countries the European Commission has confirmed that based on the laws which apply there, your Personal Data is safe there (“EU Adequacy Decision”). That applies for example to the UK, Canada and Japan. Since Liferay group of companies has offices in Canada and Japan, Liferay transfers your Personal Data to the Liferay companies in the UK, Canada, Japan and the US company Liferay, Inc. (certified under the EU-U.S. Data Privacy Framework) based on the EU Adequacy Decisions.

UK GDPR also allows free flows of Personal Data to certain countries subject to the “adequacy regulations”, including the EEA countries, Canada, Japan and US companies certified under the UK Extension to the EU-U. S. Data Privacy Framework. Since Liferay group has offices in the EEA, Canada, Japan and the US company Liferay, Inc. (certified under the UK Extension to the EU-U.S. Data Privacy Framework), Liferay transfers your Personal Data to these countries based on the UK adequacy regulations.

For transfers of your Personal Data to other countries (we will call such countries “third countries”), like Brazil, Liferay has established contracts to protect your Personal Data. We use the so-called “Standard Contractual Clauses” (“Causes”) to transfer your Personal Data to Liferay Affiliates in third countries. These Clauses very precisely describe how the recipient in a third country has to treat and protect your Personal Data. That way, even if the national data protection laws in such countries do not establish the same obligations on the companies to protect your Personal Data as in the EEA and UK, the recipients are obliged to protect your Personal Data according to the Clauses.

If you would like to read the Clauses, you can request a copy of the applicable Clauses from Liferay. Please submit such a request to [email protected] . 

Same principles apply when we need to share your Personal Data with vendors in third countries providing systems and services we use.  If such vendors are not located in the EEA or UK, but in a country which has the EU Adequacy Decision as summarized here, we rely on the EU adequacy decision to justify transfers of your Personal Data. Where the vendor is located in a third country, we rely on the Clauses, or under exceptional circumstances on one of the exceptions permitted by the GDPR/UK GDPR.

EU-U.S. Data Privacy Framework with UK Extension and Swiss-U.S. Data Privacy Framework

Liferay, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Liferay, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-U.S. DPF. 

Liferay, Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Liferay, Inc. is responsible for the processing of personal data it receives, under the DPF, and subsequently transfers to a third party acting as an agent on its behalf. Liferay, Inc. complies with the DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions.

The Federal Trade Commission has jurisdiction over Liferay’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, Liferay, Inc. may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Liferay, Inc. commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States.  If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.trustarc.com/watchdog/request for more information or to file a complaint. These dispute resolution services are provided at no cost to you.

For complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website. 

If you are located in Brazil

If you are based in Brazil, then LGPD requires Liferay to make sure that it only transfers your Personal Data to other countries if Liferay can ensure that it will be properly protected in the recipient country, too.

Therefore, we can freely transfer your Personal Data to countries, which provide for an appropriate level of protection. LGPD is a new law and the national data protection authority (ANPD) did not provide any final guidance yet on which countries would be considered acceptable. However, since we realize that LGPD is a comprehensive data protection law that is very similar to GDPR and the EU Member states have established supervisory authorities to oversee compliance and enforce the data protection laws and the EU Commission, when making EU Adequacy Decisions, applies the same requirements, we believe that it’s safe to say that EEA and countries which have received a EU Adequacy Decision will be considered “safe” in LGPD terms, too. We therefore, freely transfer your Personal Data to Liferay companies based in the EEA, UK and Japan and to Liferay, Inc. certified under the EU-U.S. Data Privacy Framework in the US.

Otherwise, LGPD allows us to transfer your Personal Data to recipients in other countries, where we can establish a proper level of data protection using specific contracts. Again, LGPD is a new law and the national data protection authority (ANPD) did not provide any final guidance yet on the exact terms of such contracts. However, since LGPD is very similar to GDPR, we believe that it’s safe to assume that the Clauses we use for transfers of Personal Data from EEA to third countries (we said we would call “clauses” above) should be sufficient, too and rely on them. This is what we use, when we need to transfer your Personal Data to countries outside the EEA and the EU Adequacy Decision countries.

Same principles apply when we need to share your Personal Data with vendors in third countries providing systems and services we use.  If such vendors are located in the EEA, or in a country which has the EU Adequacy Decision, we freely transfer your Personal Data to such recipients as we are convinced that these countries provide appropriate protections for your Personal Data. Where the vendor is located in a third country, we rely on the clauses, or under exceptional circumstances on one of the exceptions permitted in accordance with LGPD.

RETENTION OF YOUR PERSONAL DATA

Where Liferay is processing and using your Personal Data, Liferay will retain your Personal Data only for (i) as long as is required to fulfill the purposes set out in Section “How and On What Legal Bases Liferay Processes Your Data” or (ii) until you object to Liferay’s use of your Personal Data (where Liferay has a legitimate interest in using your Personal Data), or (iii) until you withdraw your consent (where you consented to Liferay’s using your Personal Data). However, where Liferay is required by law to retain your Personal Data longer or where your Personal Data is required for Liferay to assert or defend against legal claims, Liferay will retain your Personal Data until the end of the relevant retention period or until the claims in question have been settled.

In some cases, national laws will dictate how long we need to keep certain records and additional documentation necessary to understand these records. For clarity, such records on their interface might display your personal data such as your name, job title and corporate contact details, however systems storing digital documents usually contain certain metadata which enables identification of the individuals who have created or changed them. Such records are required to ensure accountability, security and auditability and will also be retained as long as required under the applicable laws or until the claims in question are settled.

While retention terms vary from country to country, but Liferay operates in an international environment, Liferay determines a unified standard for data retention based on the jurisdictions of all countries in which Liferay is or was present at some point of time. 

Generally, Liferay maintains your Personal Data for the following duration:

• Our email and chat or other business related communication with you which qualifies as business letters is retained for the duration of 10 years.
• In case you purchased any of Liferay’s products and services, your business contact information, the history of the purchases by you or your company and other related or linked information is retained for the duration of 3 years from contract expiration, except for your Personal Data eventually contained in the contractual paperwork and invoices which are retained for 10 years.
• In case you didn’t purchase any Liferay services for your own purposes or purposes of a company you represent, your business contact information and other related or linked information is retained for the duration of 18 months from your last interaction with Liferay
• Personal Data regarding your privacy preferences and other information we use for compliance purposes which is required for evidentiary purposes, is retained for 5 years from your withdrawal or previously agreed expiration of consent, or from the moment we responded to your request, settled any dispute or conducted our compliance review.
• If you participate in training and obtain a certificate, as we understand that you will use it as proof of your qualifications, we will maintain this information until you ask us to delete it.
• If you create an account at any of Liferay’s websites, and publish any comments, contributions and alike, since we understand they contribute to your professional profile in the IT industry, we maintain the accounts until you delete it or you ask us to delete it.

Except as outlined above, in case of any disputes or procedures, Liferay retains  records of the court decision or settlement for the duration of 30 years from the final settlement of the dispute. 

YOUR RIGHTS AND CHOICES

Your rights

You have the following rights in relation to our processing of your Personal Data:

• Right to access: You can ask us to give you information about whether or not your personal data is processed, and if it is, certain further details, such as with which entities your personal data has been shared;
• Right to rectification: if you deem that your data is falsely recorded in our systems, you can ask to have that rectified;
• Right to erasure: in certain situations (especially if the processing of your personal data is based on consent provided by you) you can ask that we delete, block or anonymize personal data related to you. However, we may oppose this request (especially if we have a legal obligation to retain your personal data).
• Right to object to the processing of personal data: you can oppose any processing of your personal data on the basis of the legitimate interest, on grounds relating to your particular situation, at any time.
• Right to refuse consent: if we ask you to provide consent, you should be aware that you can refuse to provide consent, without any major detriment, except eventually inconvenience. We will inform you in each particular case of the available alternatives and the consequences.
• Right to withdraw consent: if you gave your consent to us, you are free to withdraw that at any time and without any conditions. In that case we will not process your personal data in the future for the reason we sought your consent for. 
• Right to request restriction of processing: If you’re in the UK, EEA or Brazil, you also have the right to restrict the processing of personal data: there are situations (for example if you contest the accuracy of your personal data and we are verifying the accuracy of the data) in which you have the right to ask for the restriction of the processing of your personal data. If this right is exercised, we can only store your personal data, but we cannot make any other action on it (e.g. we cannot create statistics using it). 
• Right to data portability: If you’re in the UK, EEA or Brazil, under certain circumstances you can request us to enable portability of your data to another service or product provider.
• Right to be subject to  automated decision-making and profiling: to the extent Liferay uses your data for automated decision making with legal or similar effects, you have the right to opt-out of the use of your data for such purposes.

If you are a California (US) resident

You have the following rights in relation to Liferay’s processing of your Personal Data, and the terms used capitalized below but not defined in this Privacy Policy otherwise have the meaning assigned to them in the CCPA:

• Right to know: You can request Liferay to disclose to you: (1) the categories and/or specific pieces of Personal Data Liferay has collected or disclosed about you within the last twelve (12) months, (2) the categories of sources for that Personal Data, (3) the purposes for which Liferay uses that information, (4) the categories of third parties with whom Liferay discloses the Personal Data, and (5) the categories of Personal Data that Liferay Sells or discloses to third parties. You can make a request to know up to twice a year, free of charge.
• Right to access: You have the right to request a copy of your Personal Data we have held about you within the last twelve (12) months.
• Right to delete: You can request Liferay to delete the Personal Data Liferay has collected from you and tell our Service Providers to do the same, subject to certain exceptions (such as if we are legally required to keep the Personal Data to comply with legal obligations).
• Right to opt-out of sale or sharing: You may request Liferay to stop Selling or Sharing your Personal Data (“opt-out of sale or sharing”), where applicable.
• Right to correct: You may ask Liferay to correct inaccurate Personal Data that Liferay may have about you.
• Right to limit use and disclosure of Sensitive Personal Data: You can direct Liferay to only use your Sensitive Personal Data (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as processing of your order.
• Right to non-discriminatory treatment: You have the right to receive non-discriminatory treatment for the exercise of these rights.
• Financial Incentives: Liferay does not offer financial incentives in exchange for your consent for Liferay to share your Personal Data with third parties and does not limit its offerings in case you opt-out of sharing (unless, where sharing is necessary to actually perform the requested service, for example where Liferay needs to share your data with social media or third party services such as X or YouTube if you click the respective icons).
• Shine the Light Law: you can request information about the categories of Personal Data we disclose to third parties or Liferay Affiliates for the purposes of their direct marketing.

You can exercise your rights (including your right to opt-out-of-sale, if you are a resident of California) at no cost and at any time by directing an email to [email protected] or by using contact details identified in the “Data Controller and Contact Information Section” above. Liferay will confirm receipt of your requests as soon as possible, take steps to verify your identity and ensure that Liferay responds to your request within the deadlines provided by the applicable laws but in any case no later than within 30 days from receipt of your request. If we need to refuse your request, we will provide a justification. If you then should disagree, you will be able to appeal via email or letter, to be directed to the email or postal address indicated for Liferay, Inc in Section “Data Controller and Contact Information”.

While we generally prefer to resolve any disputes amicably, further to the above, if you feel that Liferay has breached the applicable data protection laws, you have the right to lodge a complaint with the data protection supervisory authority of your country:

If you are a resident of the European Economic Area and wish to raise a concern about Liferay’s use of your Personal Data, you may direct questions or complaints to the Irish Data Protection Commissioner, which is Liferay’s lead supervisory authority, at:

Irish Data Protection Commissioner
Office of the Data Protection Commissioner
Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland
Phone: +353 57 8684800
+353 (0)761 104 800
Fax: +353 57 868 4757
Email: [email protected]

Alternatively, you may contact your local supervisory authority. 

• If you are based in the EU, you can find the competent authority and the contact details here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. 
• If you are based in the UK, you can find the competent authority and the contact details here: https://ico.org.uk/make-a-complaint/  
• If You are based in Brazil, you can find the competent authority and the contact details here: https://www.gov.br/anpd/pt-br
• If You are based in the USA, California, you can find the competent authority and the contact details here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company 

For the competent authorities in other countries, please consult this map: https://www.cnil.fr/en/data-protection-around-the-world

Your Choices

You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or you can contact us at [email protected].

Accessing and updating your Personal Data

In order to ensure that your Personal Data is accurate and up to date, please notify us of any changes to your Personal Data. If you are a registered user, you may update or delete your profile online via the "My Account" area accessed through the "Settings" link in the global navigation or in accordance with the instruction provided below.
You may choose to hide or otherwise withhold displaying certain information on your public profile, including Personal Data, by making changes to your account information on the website.

CHILDREN’S ONLINE PRIVACY

Liferay operates in a B2B environment and offers enterprise grade products and services. These offerings are not directed to children and Liferay does not knowingly collect online Personal Data from children under the age of 16. If you are younger than 16, you may not access, register with or use this website. If you are a parent or guardian of a minor under the age of 16 and believe that he or she has disclosed Personal Data to Liferay, please contact Liferay via Liferay’s as described below under “How to Contact Liferay.”

CHANGES TO THIS PRIVACY POLICY

Liferay reserves the right to make corrections, changes or amendments to this Privacy Policy at any time.  If we make any material changes, we will notify you by means of a notice on our website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

HOW TO CONTACT LIFERAY

If you have any questions about Liferay’s privacy practices or use of your Personal Data, please feel free to contact Liferay by using contact details identified in the “Data Controller and Contact Information Section Above” or at [email protected]