Duo Privacy

This document is the Cisco Online Privacy Statement governing Cisco's collection, use, and sharing of personal data across Cisco and Duo Security websites, products, and services, with legal bases including consent, legitimate interests, contractual necessity, and legal obligation depending on jurisdiction. The statement asserts that Cisco collects a broad range of personal data including identifiers, authentication logs, device information, usage data, and geolocation, and the terms authorize sharing this data with Cisco affiliates, business partners, service providers, and in connection with corporate transactions such as mergers or acquisitions. The statement reserves the right to use personal data for product improvement, security research, and AI/ML model development, which extends beyond transactional service delivery and may warrant scrutiny under data minimization principles applicable in certain jurisdictions. The policy engages GDPR and EU adequacy frameworks for EEA residents, CCPA and CPRA for California residents, and references compliance with sector-specific frameworks relevant to Duo's authentication and identity management context; applicability of specific protections depends on user location and applicable law. Organizations deploying Duo as a B2B security product should note that employee authentication data processed through Duo may be governed by separate data processing agreements rather than this consumer-facing statement, creating a dual-layer governance structure that compliance teams should map carefully.