Salesforce Privacy Statement

This document is Salesforce's full Privacy Statement (effective August 26, 2025), governing the collection, use, sharing, and processing of Personal Data by Salesforce, Inc. and its affiliates acting as data controllers, explicitly excluding Salesforce's role as a processor on behalf of enterprise customers. The statement asserts that Personal Data is collected across websites, events, marketing communications, office visits, and service interactions for purposes including personalized advertising, sales prospecting, research, and legal compliance; the terms authorize sharing with service providers, affiliates, event sponsors, partners, AppExchange partners, and public authorities. Notably, the document addresses cross-border data transfers through multiple mechanisms including EU-U.S. and Swiss-U.S. Data Privacy Frameworks, EU and UK Binding Corporate Rules, and Standard Contractual Clauses, and explicitly discloses advertising-related data sharing that triggers opt-out rights, including for those under 16; the document is explicit that it does not govern data processed in Salesforce's processor capacity, which is a significant carve-out affecting enterprise customer data handled through Salesforce's CRM and cloud platforms. The statement engages GDPR, CCPA, UK GDPR, APEC CBPR and PRP frameworks, and the EU-U.S. Data Privacy Framework administered by the U.S. Department of Commerce and enforceable by the FTC; jurisdiction-dependent rights such as data portability, automated decision-making objection, and minor-specific opt-in requirements create materially different compliance obligations depending on where data subjects are located.