GDPR

LAST UPDATED: March 31, 2020

EEA Supplemental Website Privacy Statement (“GDPR Supplement”)

I. Scope of This GDPR Supplement

PDF Solutions, Inc., 2858 De La Cruz Blvd, Santa Clara, CA 95050 (USA) (“we“, “us“, “our“) provides to residents of the European Economic Area this Supplemental GDPR Website Privacy Statement (“GDPR Supplement“), which contains information provided to such residents in addition to or deviating from the PDF Privacy Policy at [/company/trust-center/privacy-policy] (“Policy“).

Unless defined specifically in this GDPR Supplement, capitalized terms shall have the meaning set forth in the Policy.

II. Controller

PDF Solutions, Inc., PDF Solutions, Inc., 2858 De La Cruz Blvd, Santa Clara CA 95050 USA operates the Site and is the controller of any personal data collected or otherwise processed on or through the Site.

III. Purposes and Legal bases for processing

We process your personal data on several different legal bases, as follows:

1. Based on necessity to enter into or perform a contract with you – we need to process your personal data to enter into an agreement with you or a legal entity you represent, to perform contractual obligations, to respond to related questions and requests from you, or provide customer support.
2. Based on legitimate interests – we process personal data from you

• for the security and safety of the Site, our IT connected to the Site and the users of the Site;
• to detect and prevent fraud;
• to protect and defend the rights or property of others, or our own rights and interests;
• to track your activities on the Site and present you with advertising based on your browsing activities and interests, provided you have not opted out of such data processing.  Detailed information about the web analytics and advertising solutions used on the Site is below:

1. Based on compliance with legal obligations – we may need to process your personal data to comply with relevant laws, regulatory requirements and to respond to lawful requests, court orders, and legal process.
2. Based on your prior consent – for placing cookies on your device (subject to certain exceptions) or sending marketing communications to you. Detailed information on our use of cookies can be found in Section 1(d) of our Privacy Policy, detailed information on our marketing communications to you is set forth immediately below.

Marketing Communications to You

On /contact you can register to receive newsletters or similar information on our products or services or the products or services of our affiliated companies. As part of the registration process, we ask you to provide us with certain mandatory information. Such information includes your email address.

When receiving a registration, we log and store the date/time of registration and the IP address the registration was received from. This solely serves evidentiary purposes in case your contact detailed are used by an unauthorized party.

In addition, we use double opt-in procedures for marketing information, thus we verify the authorized use of an email address by sending to such address an email asking for confirmation of the registration via a link. If and when the link is clicked on, we will automatically be notified that the registration has been confirmed from the email account initially used for the registration. Only upon such confirmation will the registration become effective and will we send newsletters or similar information to the respective email address (double opt-in procedure).

When registering to receive newsletters or similar information on /contact you explicitly declare your consent to our processing of your personal data for this purpose. You are under no obligation to provide such consent and, if you choose to give it, you may withdraw your consent at any time, with future effect and for any or no reason by following the unsubscribe link contained in any email communication to you or by sending us an email at privacy@pdf.com.

RECIPIENTS OF YOUR PERSONAL DATA

For the following purposes, we disclose your personal data to the following third parties, as required or permitted by applicable law:

DATA TRANSFERS TO RECIPIENTS OUTSIDE OF THE EU/EEA

We transfer your personal data outside of the country where you are located.

Some recipients located outside of the European Economic Area (“EEA“) are certified under the EU-U.S. Privacy Shield. Others are located in countries for which the European Commission has issued adequacy decisions (e.g., Canada). In each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective (GDPR Art. 45).

Some recipients are located in countries for which the European Commission has not issued an adequacy decision in respect of the level of data protection there. These countries include, but are not limited to: the U.S. (where the recipient is not Privacy Shield certified), Korea, People’s Republic of China, and Taiwan. By entering into appropriate data transfer agreements based on Standard Contractual Clauses (2010/87/EU and/or 2004/915/EC) as referred to in GDPR Art. 46 (5) or other adequate means, we have established that all such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law. You can request a copy of such safeguards by contacting privacy@pdf.com.

HOW LONG WE KEEP YOUR PERSONAL DATA

We have implemented appropriate retention periods for your personal data collected or otherwise processed on or through the Site as set forth in our privacy policy. Personal data processed in the context of a contract with you will be retained by us for the term of the contract and for a reasonable time afterwards as might be required to determine and settle any related claims. Where our processing of your personal data is based on legitimate interests or the compliance with legal obligations, it will be deleted as soon as the underlying purpose has expired. Personal data processed based on your consent will be deleted if and when you withdraw such consent.

YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

Subject to the conditions set out in the applicable law, you have, without limitation, the rights to (i) inquire whether and what kind of personal data we hold about you and how it is processed, and to access or request copies of such personal data, (ii) request the correction or supplementation of personal data about you that is inaccurate, incomplete or out-of-date in light of the purposes underlying the processing, or to (iii) obtain the erasure of personal data no longer necessary for the purposes underlying the processing, processed based on withdrawn consent, processed for legitimate interests that, in the context of your objection, do not prove to be compelling, or processed in noncompliance with applicable legal requirements. In addition, you have, subject to the conditions set out in the applicable law and without limitation, the rights to (iv) request us to restrict the processing of personal data in certain situations where you feel its processing is inappropriate, (v) object, in certain circumstances, to the processing of personal data for legitimate interests, and to (vi) request portability of personal data that you have actively or passively provided to us (which does not include data derived or inferred from the collected data), where the processing of such personal data is based on consent or a contract with you and is carried out by automated means. In case of concerns, you also have the right to lodge a complaint with the competent local data protection authority.

You may exercise the above mentioned rights of access, rectification, erasure, restriction, objection and data portability by contacting us under privacy@pdf.com, even to the extent that such claims relate to the processing of personal data by one or more of the data recipients identified in this privacy statement.

YOUR PROVISION OF PERSONAL DATA TO US

Your use of the Site and your provision of personal data to us in the process is purely voluntary on your part. Subject to your sole discretion, you can, at any point, stop using the Site or, where applicable, opt out of certain data processing operations while on the Site as described in this GDPR Supplement. An exception applies if and to the extent that you want to enter into or perform a contract with us on or through the Site. In this event, providing us with your related personal information is necessary for us to be able to enter into the contract with or provide any contractual services to you.

EFFECTIVE DATE AND CHANGES

This GDPR Supplement is effective as of the date at the top of this document. We may make changes, including material changes, to this GDPR Supplement from time to time. You should review the GDPR Supplement each time you visit our Site to learn of any changes.

If you have questions about this GDPR Supplement, please contact us at privacy@pdf.com.