Conductor Project Privacy Policy

1. Personal data we collect and why

   As used in this Policy, “personal data” means any information that relates to, describes, or could be used to identify an individual, either directly or indirectly.
   When you visit conductor-oss.org and access our logo image or launch the Docker container to run the Software, we may collect your IP address information to help us understand Software usage and interactions. We do not collect any other types of personal data through your use of the Software or your access to this Site.

2. Changes to the Terms

   1. 2.1

      Service Providers

      We may disclose personal data to our service providers, third-party vendors, consultants, and other business partners who need to process personal data to provide services on our behalf, monitor and analyze the use of our services, contact you, and for the reasons stated in this Policy.

   2. 2.2

      Law enforcement

      Under certain circumstances, we may disclose personal data if required to do so by law or in response to valid requests by public authorities (such as a court or a government agency). To the extent we receive a request from law enforcement for your personal data, we will promptly notify you and provide you with a copy of the request, unless we are legally prohibited from doing so.

   3. 2.3

      Other data sharing

      We may disclose personal data to comply with a legal obligation, to protect and defend the rights or property of the company, prevent or investigate possible wrongdoing in connection with the Software, to protect the personal safety of users of the Software or of the public, and protect against legal liability. We do not share information that reasonably identifies you or your organization with unaffiliated entities except as expressly described in this Policy or with your express prior permission. Please note that Conductor may be obligated to keep certain information on record should data be disclosed in accordance with this Policy.

   4. 2.4

      Transfers

      Your information, including personal data, is processed at our operating offices and in any other places where the parties involved in the processing are located. This means that information may be transferred to- and maintained on- computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. Your consent to this Privacy Policy represents your agreement to that transfer.
      We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your personal data will take place to an organization or a country unless there are adequate controls in place, including the security of your data and other personal information.

3. How long do we retain personal data?

   We will retain your personal data only for the period necessary to fulfill the purposes outlined in this Policy, and will retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. Conductor deletes collected IP addresses every thirty (30) days.

4. Security of your personal data

   The security of your personal data is important to us, but no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

5. Children’s privacy

   We do not knowingly collect, retain, or use personal data from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from anyone under the age of 13, we will take reasonable steps to delete such information from our servers.

6. Changes to this Privacy Policy

   We may update our Privacy Policy from time to time, and we will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our service prior to the change becoming effective, and update the “Last Updated” date at the top of this Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

7. Supplemental Terms and Conditions for certain regions

   1. 7.1

      Europe

      If you are located in the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”), our legal basis for collecting and using the personal data described in this Policy will depend on the personal data concerned and the specific context in which we collect it. However, we will normally collect personal data from you only where we have your consent to do so, where we need the personal data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal data from you.
      Conductor may share information internally or with third-parties, as described in this Policy. When we share personal data of individuals in the EEA, Switzerland, or UK with third-parties, we make use of a variety of legal mechanisms to safeguard the transfer, including the European Commission-approved standard contractual clauses, as well as additional safeguards where appropriate.
      Additionally, you have the following data protection rights:
      • You can request access,correction, updates, or deletion of your personal data.
      • You can object to our processing of your personal data, ask us to restrict processing of your personal data, or request portability of your personal data.
      • If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.
      • You have the right to complain to a data protection authority about our collection and use of your personal data.
      To exercise your rights, please contact privacy@orkes.io

   2. 7.2

      California

      The following applies solely to residents of California or individuals whose information has been collected in California. Conductor has adopted and included this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms used in this section that are defined in the CCPA have the same meaning given therein.

      • 7.2.1

        Information we collect

        Category

        Collected?

        Disclosed?

        1.

        Identifiers- name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

        Yes

        Yes

        2.

        Personal information categories under the California Customer Records statute (Cal. Civ. Code § 1798.80(e))- A name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.

        No

        No

        3.

        Protected classification characteristics under California or federal law- Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

        No

        No

        4.

        Commercial information- records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

        No

        No

        5.

        Biometric information- genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

        No

        No

        6.

        Internet or other similar network activity- browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

        No

        No

        7.

        Geolocation data-physical location or movements

        No

        No

        8.

        Sensory data- audio, electronic, visual, thermal, olfactory, or similar information

        No

        No

        9.

        Professional or employment-related information- current or past employment history or performance evaluations

        No

        No

        10.

        Education information under California Family Educational Rights and Privacy Ct (20 U.S.C. §1232g, 34 C.F.R. Part 99)- information that is not “publicly available personally identifiable information” as defined in the California Family Educational Rights and PRivacy Act (20 U.S.C. §1232g, 34 C.F.R. Part 99). Includes education records directly related to a student maintained by an educational institution or party acting on its behalf, like grades, transcripts, class lists and student schedules, identification codes, financial information, or disciplinary records.

        No

        No

        11.

        Inferences- conclusions that could be used to create a profile reflecting an individual’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitude.

        No

        No

      • 7.2.2

        Selling information

        Conductor does not sell your personal information, as defined under the CCPA. If in the future we do sell your personal information, we will notify you and you may have the rights to opt-out of such sale.

      • 7.2.3

        Your rights and choices

        The CCPA provides individuals residing in California or whose personal information was collected in California with specific rights regarding their personal information. The below describes your rights and how you may exercise them.

        • 7.2.3(a)

          Access to specific information and data portability rights

          You have the right to request that Conductor disclose certain information to you about our collection and use of your personal information over the past twelve (12) months. Once Conductor receives and confirms your verifiable information access request, Conductor must disclose to you: (i) the categories of personal information we collected about you, (ii) the categories of sources for the personal information we collected about you, (iii) our business or commercial purpose for collecting or, if applicable, selling that personal information, (iv) the categories of third parties with whom we share that personal information, (v) the specific data points or pieces of personal information we collected about you. If we disclosed for a business purpose or sold your personal information, Conductor must also provide separate lists that (a) identify the personal information categories that were sold to each category of recipient in connection with sales of your personal information, and (b) identify the personal information categories that were provided to each category of recipient in connection with business purposes disclosures of your personal information.

        • 7.2.3(b)

          Deletion request rights

          You have the right to request that Conductor delete any of your personal information that we collected from you and/or retained. Unless subject to a certain limited exception, once Conductor receives and confirms your verifiable data deletion request, we will delete (and direct our services providers to delete) your personal information from our records. Conductor will notify you promptly if it determines it must deny your deletion request.

        • 7.2.3(c)

          Do not sell opt-out rights

          You have the rights to opt-out of any sales, as defined by the CCPA, of personal information by Conductor. However, Conductor does not sell your information.

      • 7.2.4

        Exercising your rights

        To exercise your access, data portability, deletion, or do not sell opt-out rights described above, you may submit a verifiable consumer request by emailing legal@conductor-oss.org.
        You may only make a certifiable consumer request for access or data portability up to two times within a 12-month period. You may make a verifiable do not sell opt-out request at any time. Any such request must: (i) provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized representative thereof, and (ii) describe your request with sufficient detail such that we may understand, evaluate, and respond to it. Conductor cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. Making a verifiable consumer request does not require you to create an account with Conductor. Conductor will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make verifiable consumer requests related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

        • 7.2.4(a)

          Response timing and format

          We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you in writing of the extension period and the reason for it. Conductor will deliver any required or requested responses or other communications in writing to you by email. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. If applicable, the response we provide will also explain any reasons we cannot comply with a request. For data portability requests, we will provide your personal information in a format that is readily usable and transferable. Conductor does not charge a fee to process or respond to your verifiable consumer request unless such requests become excessive, repetitive, or manifestly unfounded or as otherwise permitted by the CCPA. If we determine that a request warrants charging a fee, we will notify you and provide you with a cost estimate before completing your request.