This Privacy Policy applies to Oracle’s processing of personal information that Oracle has obtained from an Oracle customer when agreed to by contract with that customer to use such information for AI/ML processing for the purposes specified in this Privacy Policy. The following Oracle lines of business may process personal information under this policy: NetSuite.

Oracle America, Inc., having its registered address at 2300 Oracle Way, Austin, TX, 78741, USA, is responsible for processing your personal information in scope of this Privacy Policy.

For personal information sourced in the EU/EEA, Oracle America, Inc.’s EU representative is Oracle EMEA Limited, having its registered address at East Point Business Park, Fairview, Dublin 3, Ireland.

For personal information sourced in the UK, Oracle America, Inc.’s UK representative is Oracle Corporation UK Ltd, having its registered address at Oracle Parkway, Thames Valley Park (TVP), Reading, Berkshire, RG6 1RA, UK.

Personal information that can directly or indirectly identify you may include, for example:

Oracle may also collect customer and systems operations data, which may incidentally contain personal information:

In cases where the processing of personal information is not central to the purposes of processing for the below AI/ML activities, Oracle will limit the use of personal information when technically possible or feasible. ‘Dataset’ refers to a set of data that may contain this limited personal information.

We use personal information for the following business purposes:

These purposes are described below in further detail.

Personal information subject to this Privacy Policy is provided to Oracle from Oracle customers when agreed to by contract with the customer.

Oracle will process information about you as may be necessary for internal research for technological development and demonstration and to improve, upgrade, or enhance Oracle products and services based on our legitimate interests when such processing has a limited privacy impact on the individual.

Oracle will process information about you as may be necessary to detect, prevent, or predict malicious, deceptive, fraudulent, or illegal activity on Oracle sites, networks, and systems based on our legitimate interests in order for Oracle to safeguard such systems.

Oracle may also process personal information as necessary for compliance with our legal obligations.

Oracle maintains personal information provided by Oracle customers for processing to achieve the intended purposes described in this Privacy Policy for only as long as necessary, which is approximately 3 months but no longer than 12 months. Oracle will maintain evidence of access, opt-out, or deletion requests as long as necessary to document Oracle’s compliance with such requirements.

Sharing within Oracle

As a global organization, information about you can be shared with other Oracle entities globally throughout Oracle’s worldwide organization as needed for the purposes of processing.

Oracle employees are authorized to access personal information only to the extent necessary to serve the applicable purpose(s) and to perform their job functions.

Sharing with or selling with third parties

We do not share or sell personal information subject to this Privacy Policy with third parties for any commercial purposes.

We may share such personal information with the following third parties for a business purpose:

Oracle is a global corporation with operations in over 80 countries and personal information is processed globally as necessary in accordance with this policy. If personal information is transferred to an Oracle recipient in a country that does not provide an adequate level of protection for personal information under applicable data protection law in the country where such information was collected, Oracle will take adequate measures designed to protect the personal information, such as ensuring that such transfers are subject to EU Model Clauses or other adequate transfer mechanism as required under relevant data protection laws.

Oracle has implemented appropriate technical, physical and organizational measures designed to protect personal information against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access, as well as all other forms of unlawful processing.

Pursuant to the E.U. General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Brazilian General Data Protection Law (LGPD) and other applicable laws and regulations, individuals in certain jurisdictions may have data subject rights enabling them to opt-out of third party sharing or selling, delete or correct, or request to access and receive a copy of their personal information in Oracle’s possession or for which Oracle is otherwise responsible. Please see the Privacy Choices page for more information.

Oracle provides rights to individuals to access, amend, correct, or delete data for personal information that directly identifies such individuals, such as their name or email address.

We will respond to your request consistent with applicable law. Oracle will not discriminate against consumers who have exercised the deletion, opt-out, or access rights provided to them in this Privacy Policy.

Under the California Consumer Privacy Act (CCPA), as amended, California residents may request that we:

Oracle will not discriminate against you if you exercise these rights under the CCPA.

We will respond to your request consistent with applicable law. If you are an authorized agent making an access or deletion request on behalf of a Californian resident, please reach out to us via the inquiry form and indicate that you are an authorized agent. We will provide you with instructions on how to submit a request as an authorized agent on behalf of a Californian resident.

If you are a California resident, you may obtain information about exercising your rights, as described above, by contacting us at 1-800-633-0748. For information on the CCPA requests Oracle received, complied with, or denied for the previous calendar year, please visit Oracle’s Annual Consumer Privacy Reporting page, available here.

We do not knowingly process personal information of children under 16 years of age or personal information that is sensitive or “special” under applicable data protection laws.

Oracle will not use the personal information processed under this policy to make decisions related to an individual’s eligibility for employment, credit, healthcare, or insurance purposes or to make decisions solely by automatic means where the decision has a legal or significant effect on the individual, or in any way that may or does discriminate against any person or promote bigotry, racism or harm.

Oracle has appointed a Global Data Protection Officer. If you believe your personal information has been used in a way that is not consistent with the Privacy Policy or your choices, or if you have further questions, comments or suggestions related to this Privacy Policy, or if you wish to exercise your right to access to your offline personal information as described in this Privacy Policy, please contact the Global Data Protection Officer by filling out an inquiry form.

Written inquiries to the Global Data Protection Officer may be addressed to:

Oracle Corporation Global Data Protection Officer Willis Tower 233 South Wacker Drive 45th Floor Chicago, IL 60606 U.S.A.

If you have any complaints regarding our compliance with this Privacy Policy, please contact us by filling out an inquiry form. We will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with this Privacy Policy and in accordance with applicable law. You also have the right to file a complaint with a competent data protection authority if you are a resident of a European Union member state.

Oracle’s corporate headquarters are located at:

2300 Oracle Way Austin, TX 78741 USA

Tel: +1.737.867.1000

Previous version: 05/05/22 | 01/14/22