Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that NVIDIA collects identity enrichment data including names, email addresses, job titles, company affiliations, associated industries, and social media handles from third-party data providers, combines it with other data NVIDIA holds, and shares it with business partners for marketing communications.
This analysis describes what NVIDIA NIM's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes the combination of third-party sourced enrichment data with NVIDIA's own data holdings and the onward sharing of that combined data with business partners for marketing, creating multi-party data flows that may require evaluation under GDPR, CCPA, and applicable data broker regulations. The inclusion of social media handles as a collected and shared data category is operationally distinct from standard contact data enrichment practices.
The updated Privacy Policy removes all disclosure language about how NVIDIA and third-party partners use cookies and other tracking technologies. Previously, the policy stated that cookies were used 'to collect and record information' for 'performance improvement, analytics, and to assist in our marketing efforts' and described consent mechanisms like 'Accept All' and 'Manage Settings'. The updated policy contains no equivalent disclosure of these tracking practices, data collection methods, or consent options. You can review NVIDIA's full Privacy Policy at their Privacy Center, though the updated version no longer describes cookie and tracking technology practices that were previously disclosed.
View change record →This provision reveals new third-party data acquisition and sharing practices for identity enrichment that expand the scope of data collection beyond what users directly provide.
View full change record →Under this clause, NVIDIA may combine data obtained from third-party enrichment providers, including social media handles and industry affiliations, with other personal data it holds, and share the combined dataset with business partners for marketing purposes. The agreement states this processing is based on legitimate interest, meaning it does not require prior consent in jurisdictions where legitimate interest is a valid lawful basis.
Cross-platform context
See how other platforms handle Identity Enrichment Data Sharing with Third-Party Vendors and similar clauses.
Compare across platforms →Monitoring
NVIDIA NIM has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We collect identity and enrichment data from third-party sources such as your name, email, job title, company, associated industries, and social media handles. We use this data, alone or combined with other information about you, to more effectively communicate with you and others, including by customizing online content you view or making recommendations. We process this data based on our legitimate interest in finding and communicating with potential customers. We share this information with business partners so they can communicate with you about relevant products or services.Excerpt from NVIDIA NIM's NVIDIA Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR's requirements for lawful basis, transparency, and data minimization, as well as CCPA's notice and opt-out requirements for sharing personal data with third parties for cross-context behavioral advertising. The combination of third-party enrichment data with first-party data and subsequent sharing with business partners may trigger CCPA's definition of data sharing for cross-context behavioral advertising purposes, which requires an opt-out mechanism under CPRA. State data broker registration requirements in California, Vermont, and other states may apply to NVIDIA's enrichment data vendors. 2) GOVERNANCE EXPOSURE: Medium. The combination and onward sharing of enrichment data including social media handles with business partners creates data lineage complexity that may require documentation for GDPR Records of Processing Activities and CCPA data mapping compliance. The use of legitimate interest as the basis for combining and sharing this data may face challenge under GDPR's data minimization and purpose limitation principles. 3) JURISDICTION FLAGS: California residents may have CPRA opt-out rights with respect to the sharing of enrichment data with business partners for advertising-related purposes. EU and UK data subjects may object to processing based on legitimate interest. The collection and sharing of social media handles may interact with platform-specific terms of service for LinkedIn, Twitter/X, and other networks whose data is included in enrichment datasets. 4) CONTRACT AND VENDOR IMPLICATIONS: Named enrichment vendors 6Sense and Leadspace operate as data processors or joint controllers depending on the processing context; compliance teams should confirm whether current data processing agreements with NVIDIA address the use and onward sharing of enrichment data. Organizations whose employee data appears in commercial enrichment databases should assess whether their data governance policies address third-party enrichment flows. 5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether NVIDIA's sharing of enrichment data with business partners constitutes a sale or sharing of personal information under CCPA/CPRA, which would require an opt-out mechanism. Data mapping updates should capture enrichment data as a distinct data source with its own lineage, retention, and sharing profile. EU operations should confirm that a legitimate interest assessment has been conducted and documented for this processing activity.
This provision authorizes the combination of third-party sourced enrichment data with NVIDIA's own data holdings and the onward sharing of that combined data with business partners for marketing, creating multi-party data flows that may require evaluation under GDPR, CCPA, and applicable data broker regulations. The inclusion of social media handles as a collected and shared data category is operationally distinct …
Under this clause, NVIDIA may combine data obtained from third-party enrichment providers, including social media handles and industry affiliations, with other personal data it holds, and share the combined dataset with business partners for marketing purposes. The agreement states this processing is based on legitimate interest, meaning it does not require prior consent in jurisdictions where legitimate interest is a …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by NVIDIA NIM.