Salesforce uses your personal data for a wide range of purposes including showing you personalized ads, prospecting you as a sales lead, running events, conducting research, and complying with legal requirements.
This analysis describes what Salesforce's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The inclusion of 'to prospect sales leads' as an explicit processing purpose means Salesforce may use personal data collected from website visits or other interactions to target individuals as potential customers, which some users may not anticipate.
Interpretive note: The specific legal bases relied upon for each processing purpose are not detailed in this summary document; the full Privacy Statement is referenced for further details, and the adequacy of those legal bases would require review of the complete document.
Salesforce may use your personal data collected through website visits, event registrations, or other interactions to identify and contact you as a potential customer, display personalized advertisements, and conduct research. These are broad processing purposes that go beyond simply running the service you interact with.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
Monitoring
Salesforce has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect and process Personal Data for a variety of purposes, including but not limited to the following: to provide our websites (including our social media pages); to display personalized advertisements and content; to manage event registrations, attendance, and participation in webinars, contests or promotions; to ensure the safety and security of our offices, premises, employees and events; to send marketing communications; to handle support or service-related requests; to prospect sales leads; to develop and optimize the performance of our services; to manage and document our customer and user accounts; to administer surveys and conduct research; and to comply with our legal obligations and defend Salesforce.— Excerpt from Salesforce's Salesforce Privacy Statement
REGULATORY LANDSCAPE: Each processing purpose requires a distinct legal basis under GDPR. Marketing communications and personalized advertising typically rely on consent or legitimate interests, both of which require specific analysis. Sales prospecting using personal data engages GDPR's legitimate interests test and may also trigger direct marketing rules under the EU's ePrivacy Directive (the 'Cookie Law'). The statement commits to obtaining prior consent where legally required, but does not specify which purposes rely on which legal bases in this summary document. GOVERNANCE EXPOSURE: Medium. The breadth of stated purposes is commercially typical for a company of Salesforce's scale, but each purpose requires documented legal basis analysis under GDPR. The sales prospecting purpose in particular may face legitimate interests challenges from individuals who did not directly provide their data to Salesforce but whose data was obtained from third-party sources. JURISDICTION FLAGS: EU and UK users have the strongest rights to object to processing for direct marketing purposes under GDPR, which must be honored absolutely. California residents have the right to opt out of the sale or sharing of their data used for marketing or advertising. Other jurisdictions with opt-out based marketing regimes (Canada's CASL, Australia's Spam Act) may also be relevant depending on user location. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose employee or contact data may appear in Salesforce's own marketing database (e.g., through conference registrations or website form submissions) should be aware that this data may be subject to Salesforce's sales prospecting practices independent of the enterprise customer relationship. COMPLIANCE CONSIDERATIONS: Legal teams should review the full Privacy Statement to identify the specific legal bases relied upon for each processing purpose listed here. Consent mechanisms for marketing communications should be audited to confirm they meet applicable standards. Data minimization reviews should assess whether all eleven listed purposes require the same categories of personal data.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The inclusion of 'to prospect sales leads' as an explicit processing purpose means Salesforce may use personal data collected from website visits or other interactions to target individuals as potential customers, which some users may not anticipate.
Salesforce may use your personal data collected through website visits, event registrations, or other interactions to identify and contact you as a potential customer, display personalized advertisements, and conduct research. These are broad processing purposes that go beyond simply running the service you interact with.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Salesforce.