Salesforce Privacy Statement

This document is Salesforce's corporate Privacy Statement (effective August 26, 2025), governing the collection, use, sharing, and processing of Personal Data by Salesforce, Inc. and its affiliates acting as data controllers. It covers data collected through website interactions, marketing communications, events, office visits, and related activities, and establishes a comprehensive set of individual rights including access, rectification, erasure, portability, objection, and opt-out of cross-context advertising. The statement addresses international data transfers through mechanisms including EU Standard Contractual Clauses, EU-U.S. Data Privacy Framework, Swiss-U.S. DPF, and Binding Corporate Rules. Notably, Salesforce explicitly carves out its processor role on behalf of enterprise customers, limiting the statement's applicability in those contexts. Contact mechanisms are provided for rights requests via web form, email, phone, and postal address.

This Privacy Statement engages GDPR (via Standard Contractual Clauses, Binding Corporate Rules, and Data Protection Officer designation), the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, UK data protection law (UK BCRs), CCPA/CPRA (California residents' rights including opt-out of cross-context …