Salesforce Privacy Statement

This document is Salesforce's full Privacy Statement (effective August 26, 2025), governing Salesforce's processing of Personal Data as a controller across its websites, services, events, offices, marketing activities, and supplier relationships; it explicitly excludes processing conducted as a data processor on behalf of customers. The statement asserts a broad range of processing purposes including personalized advertising, AI-assisted processing, sales prospecting, phone call recording, CCTV surveillance, biometric data collection at events (where consent is provided), and sharing Personal Data with service providers, affiliates, event sponsors, partners, third-party advertising networks, and public authorities. Notably, the document authorizes the use of artificial intelligence to process Personal Data 'to develop and deploy AI systems,' collects personal identifiers, professional data, behavioral data, and inferences from third-party advertising data providers for tailored advertising, and states that it does not commit to responding to browser DNT signals. The statement references compliance with GDPR, CCPA, the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the DPF, EU Processor Binding Corporate Rules, UK Processor Binding Corporate Rules, APEC CBPR and PRP certifications, and standard contractual clauses for international data transfers. Compliance teams should note the controller-versus-processor distinction as a material scoping boundary, the assertion of legitimate interest as a legal basis for a wide range of processing activities including direct marketing and personalized advertising, the collection of special categories of Personal Data (biometric, health) under consent at events, and the cross-border transfer framework relying on DPF certification and SCCs, which may require evaluation under applicable EU, UK, and Swiss data protection law.