Vertex Privacy Policy

Vertex Inc. Tax Technology at the speed of business

Vertex Inc. and its affiliates and business units (collectively, "Vertex", we," "us" or "our") are committed to respecting your privacy. In support of our commitment, we developed this privacy notice in order to be transparent about the data we collect about you and how it is used and shared, as well as the choices and rights available to you with respect to the data we maintain about you.

This privacy notice applies to all Vertex websites, applications, communications, advertisements and other online services and resources that display or link to this privacy notice (collectively, our "websites and online services"), but excluding websites or online services that display or are otherwise provided under a different privacy notice; information about you collected offline (for example, information contained in business cards provided to us at a trade show), but excluding instances where your information is collected under a different privacy notice made available to you at the time your information is collected; and information about you shared with us by third parties for our own use, as well as publicly available information collected by us.

If you have any questions about this privacy notice, our use of your personal data or your rights with respect to such use, you may contact the applicable Vertex affiliate using any of the options below:

The Office of the General Counsel
Vertex, Inc.
2301 Renaissance Blvd.
King of Prussia, PA 19406
USA

Legal@Vertexinc.com

844-321-3346

Privacy Rights Request Form

I. Information We Collect and How We Use It

We collect or process information that either directly identifies you or could reasonably be used in combination with other information to identify you. (We refer to this type of data as "personal data".) Examples of personal data that directly identifies you include your name, home address, email address, telephone number and government ID number, as well as any other information combined with such direct identifiers (for example, your email address associated with you purchase history). We collect your personal data when you provide it to us directly (for example, when you submit a contact form or product order through our website, or provide us with your business card at a trade show); when it is shared with us by our business partners (for example, email marketing vendors or trade show sponsors); and when available through publicly available sources (for example, information shared on LinkedIn). The collection and use of personal data is further described under Collection and Use of Personal Data below.

We also collect certain non-personal data that does not, on its own, identify any specific individual, but which may be used to identify that a specific computer or device has accessed our websites and online services (for example, a unique device identifier). We collect and process non-personal data when generated automatically through your use of our websites and online services; through the use of cookies and similar technologies; and when we aggregate or anonymise information (including personal data). The collection and use of non-personal data is further described under Collection and Use of Non-Personal Data below.

Collection and Use of Personal Data

Personal Data Collected

Customers. We collect and process personal data about former, actual and potential customers (if natural persons), and representatives, employees, agents and contact persons associated with business customers. Personal data about customers may include:
- Contact information (for example, full name; work or home postal address; work, mobile or home telephone number; work fax number; work or personal email address; country; employer; job title).
- Engagement information (for example, order, engagement and collaboration history; contractual relationship information; delivery or payment information; inquiries, feedback and comments; and content contained in email exchanges).
- Interests and preferences data (for example, contact and product preferences; languages; marketing preferences; website and services preferences; and demographic data).
Business Partners. We collect and process personal data about former, actual, and potential contractors, agents, distributors, consultants, service providers, suppliers, vendors, licensors, licensees, and contract partners (if natural persons), and each of their respective representatives, employees, agents and contact persons (if businesses). Personal data about business partners may include:
- Contact information (for example, full name; work or home postal address; work, mobile or home telephone number; work fax number; work or personal email address; country; employer; job title).
- Engagement information (for example, order, engagement and collaboration history; contractual relationship information; delivery or payment information; inquiries, feedback and comments; and content contained in email exchanges).

Users of Our Websites and Online Services. We collect and process personal data about former, actual, and registered users of our websites and online services (for example, individuals registered to use our online portals, or users of our mobile apps). Personal data about users of our websites and online services may include:
- Contact information (for example, full name; work or home postal address; work, mobile or home telephone number; work fax number; work or personal email address; country; employer; job title)
- Online form data (for example, inquiries, feedback and comments; preferences and interests; order information; login credentials; and any other content contained in online submissions).
- Navigational data (for example, information about a website user's computer and visits to Vertex websites, such as IP address or device identifier; geographical location; browser type; referral source; length of visit; pages viewed).
- Interests and preferences data (for example, contact and product preferences; languages; marketing preferences; website and services preferences; and demographic data).
Job Candidates. We collect and process personal data about former, actual, and potential job candidates and prospects who submit resumes or otherwise apply for a position through our websites and online services. Personal data about job candidates may include:
- Contact information (for example, full name, address, phone number, fax number, email address, mobile phone number).
- Education and experience information (for example, education and work experience; and CV information, such as professional experience, employment history, education, certifications, personal interests).
Regulators. We collect and process personal data about former and actual members, representatives, employees, directors, officers, contractors, consultants and agents of governmental or other authorities and offices and regulatory bodies. Personal data about regulators may include:
- Contact information (for example, full name; title; position; employer/agency; personal or professional address, phone and email).
- Background information (for example, professional life related information; education; interests and opinions; assessments; engagement and collaboration history).

Use of Personal Data

We use personal data about customers, business partners and users of our websites and other online services for the purposes for which such personal data was provided. Where we seek and obtain your consent to engage in these processing activities, we will rely on such consent to process your personal data until you withdraw it. In other cases, we will process your personal data as necessary to perform or provide the requested services or information.
We use personal data about customers, business partners, and users of our websites and other online services to personalise Service experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our websites and other online services, third-party sites, and via email or text message. Where we seek and obtain your consent to engage in these processing activities, we will rely on such consent to process your personal data until you withdraw it. In other cases, we will process your personal data as necessary for our legitimate business interests.
We use personal data about users of our websites and other online services to help maintain the safety, security, and integrity of our websites and other online services, products, databases and other technology assets. We will process your personal data as necessary for our legitimate business interests or as required by applicable law.
We use personal data about customers, business partners, regulators and users of our websites and other online services for testing, research, analysis, and product development, including to develop and improve our websites and other online services and products. We will process your personal data as necessary for our legitimate business interests or as required by applicable law.
We use personal data about customers, business partners, regulators and users of our websites and other online services to respond to law enforcement requests and as required by applicable law, court order or governmental regulations. We will process your personal data as necessary for our legitimate business interests or as required by applicable law.
We use personal data about customers, business partners, regulators and users of our websites and other online services in order to communicate with you about any of the processing activities described in this privacy notice. Where we seek and obtain your consent to engage in these communications, we will rely on such consent until you withdraw it. In other cases, we will process your personal data as necessary for our legitimate business interests or as required by applicable law.
We may use personal data about customers, business partners, regulators and users of our websites and other online services as otherwise described to you when collecting your personal data or as otherwise set forth in this privacy notice.

Collection and Use of Non-Personal Data

When you use our websites and other online services we may collect certain data automatically that does not directly identify you, but which may be used to identify that a specific computer or device has accessed our websites and other online services. This data may include the following:

Log Data. When you use or interact with our websites and other online services, our servers record certain information that is automatically reported by your browser (such as Apple's Safari, Microsoft's Edge, Google's Chrome or Mozilla's Firefox) or device each time you request our website or other online services or when content is downloaded to your browser or device from our website. This 'log data' may include your IP address, which may change each time you connect to the Internet (a 'dynamic' IP address) or remain the same (a 'static' IP address); browser settings (for example, browser type, cookie/DNT preferences); device information (for example, type of device, operating system, device manufacturer); device ID and/or advertising ID; referring URL; request/response date and time; language (for website content); and data contained in cookies and similar technologies (discussed below).
Location Data. Depending on the website or other online service features or content and your computer or device permissions, we may collect information about your device's approximate (for example, country or postcode) or precise location. Various technologies may be used to collect this location information, such as IP address, GPS and other sensors that may provide information on nearby devices, Wi-Fi access points and cell towers. We will only collect your computer's or device's precise location with your consent.
Cookie Data. Our websites and other online services may use cookies, pixel tags, software development kits, statistical identifiers and similar technologies (referred to as "cookies and similar technologies") to collect and store certain log data and other information when you visit or interact with our websites and other online services in order to identify your browser or device and enable certain features and functionality.

We may also use cookie data, location data and log data to maintain and improve our websites and other online services, verify and authenticate users of our websites and other online services, prevent fraud and secure our websites and other online services and databases, process payments, facilitate product and service delivery, remember and analyse user preferences and interests, track and measure Service performance and effectiveness, develop and improve our products and services, deliver ads relevant to user interests or based on user location, demographics or device characteristics, and for any other purpose described in this privacy notice. Where we seek and obtain your consent to engage in these processing activities, we will rely on such consent until you withdraw it. In other cases, we will process your personal data as necessary for our legitimate business interests or as required by applicable law.

Combining Information

Where permitted by law, we may combine the personal data you provide to us through the websites and other online services with information we collect through other Vertex websites and other online services, Vertex's offline records, and information provided to us by third parties. Where permitted by law and feasible, we may also combine your personal data with information generated automatically through your use of the websites and other online services (such as log data or cookie data), in which case we will treat any information that is combined or associated with your personal data as personal data for as long as it can reasonably be linked with your personal data. We use this consolidated information to improve our websites and other online services and product offerings, enhance our marketing and research activities, communicate information to you, and engage in any other legitimate business activities set forth in this privacy notice. The processing activities may be based on our legitimate business interests, your consent (if and when obtained, unless you withdraw such consent), or where required by applicable law.

II. How Personal Data is Shared and Transferred

Personal Data Shared with Third Parties

We may disclose your personal data to third parties who provide us with various business services (for example, monitoring and maintaining our websites and internal business applications, preparing newsletters and mailings, payroll processing). These service providers and contractors are restricted from using this data in any way other than to provide services for us and subject to our documented instructions only.

We may also partner with other companies to provide you with products, services, or content on a joint or 'co-branded' basis. If we offer co-branded products, services or content, you may see both our logo and the logo of the co-branded partner. To access or use co-branded products services, or content, you may have to provide certain requested information which may be shared with our co-branded partners. You should read the individual privacy policies and terms of use of our co-branded partners, as these may differ in some respects from this privacy notice. Remember, you can always opt-out of sharing your personal data with a co-branded partner by choosing not to use the product, service or content provided.

We may also share your personal data with other affiliates within our group of companies (for example, for internal administrative purposes or where a Vertex affiliate supports a particular Vertex business function), in compliance with applicable laws.

In addition, we may disclose your personal data to third parties in special cases, including when we have a reason to believe that such disclosure is necessary to identify, contact or bring a legal action against someone who may be causing injury to or interference with our rights and property or those of any other person. We may also disclose your personal data when we believe the law requires it and in any situation that involves threats to any person's physical safety. This includes, but is not limited to, disclosures to law enforcement personnel or government agencies and authorities.

If all or part of Vertex is merged into another entity, the information we have about you may be transferred to a third party as part of that transaction. The acquiring entity will be required to use the personal data that is transferred only in a manner that is consistent with this privacy notice.

International Transfers of Personal Data

In some instances, the service providers, business partners, Vertex affiliates and others that we share personal data with are located in other countries. The level of protection for your personal data in these other countries may not be the same as the level of protection in your country. In these cases, we protect any information transferred to third countries using appropriate safeguards, such as contractual clauses approved by relevant supervisory authorities (where applicable). For example, if you reside in Europe or your personal data is otherwise subject to European law, all Vertex affiliates that access or receive your personal data are subject to data protection contracts approved by the European Commission and that impose on such affiliates a level of protection for your personal data equivalent to European data protection requirements.

In any event, we only share personal data with Vertex affiliates and third parties performing services on our behalf if such affiliates and third parties provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing they conduct will meet the requirements of applicable law and ensure the protection of your privacy.

III. Your Rights

You have a number of rights with respect to our processing of your personal data, as described below. To exercise any of these rights, please contact the Vertex affiliate responsible for the processing of your personal data using the applicable contact information below.

Access Right

You have the right to request access to your personal data and to receive the following information regarding our processing of your personal data:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed;
the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
with respect to any personal data collected from third parties (if any), any available information as to the source of such personal data; and
information regarding any transfers of personal data to other countries, including the legal mechanism used to lawfully transfer such data (if required by applicable law).

This privacy notice is intended to provide all of this information. Any questions about these details may be directed to the Vertex affiliate responsible for the processing of your personal data using the applicable contact information below.

Right to Object / Right to Withdraw Consent

You have the right to object to the processing of your personal data for direct marketing purposes, or when such processing is based solely on our legitimate business interests, or as otherwise permitted under applicable law.

Other Rights

In addition the rights described above, you also have the following rights with respect to the processing of your personal data:

The right to request rectification of any personal data that is inaccurate or incomplete.
The right to request a copy of your personal data in electronic format so that you can transmit the data to third parties, or to request that Vertex directly transfer your personal data to one or more third parties. This right applies only when personal data is processed based on your consent or a contract with you, and subject to certain other limitations under applicable law.
The right to have your personal data erased when it is no longer needed for the purposes for which you provided it, or where you withdraw your consent to the processing of your personal data (to extent the processing of your data is based on your consent), or as otherwise permitted under applicable law. You also have the right to restriction of processing of your personal data to certain limited purposes where erasure is not possible.
The right to lodge a complaint with the applicable supervisory authority where you believe that your rights have been violated. If you reside in Europe: a complaint may be lodged with a supervisory authority in the country of your residence, place of work, or place of an alleged infringement of this privacy notice or applicable European law. A list of all European supervisory authorities and their respective contact information is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.
The right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you.

IV. How We Protect Personal Data

We provide reasonable technical, physical, and organisational safeguards to protect your personal data. For example, we limit access to your personal data to authorised employees, service providers, and contractors who need access to perform the activities described in this privacy notice. Although we strive to provide reasonable security for personal data we process and maintain, no security system can prevent all potential security breaches. In particular, email or forms sent using our websites and other online services may not be secure. You should take special care before deciding to send us information via email. If you create an account through our websites and other online services, it is your responsibility to protect your access credentials from unauthorised access or use.

V. Retention and Deletion of Personal Data

Vertex implements and maintains reasonable restrictions on the retention of personal data and generally disposes of such personal data once it is no longer necessary for the purposes for which it was collected or further processed. However, we may continue to store archived copies of your personal data for legitimate business purposes and as necessary to comply with the law. In addition, we may continue to store anonymous or anonymised information for any legitimate business use described in this privacy notice.

VI. California Privacy Rights

The notice below is provided to California residents who are users of our websites and online services. This section should be read and understood in the context of our overall privacy practices.

Depending on the nature of your interaction, our website collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device.

Our website may collect the following categories of personal information from consumers:

Category	Examples	Collected
Identifiers	First name, last name, online identifier, mailing address, Internet Protocol (IP) address, email address and/or other similar identifiers	Yes
Personal Information Categories listed in the California Consumer Records statute (Cal.Civ. Code §§ 1798.80 (e))	First and last name, mailing address and/or telephone number Some personal information included in this category may overlap with other categories.	Yes
Protected classification characteristics under California or federal law	Age, race, colour, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)	Yes* *This information would only be collected during an application process and is optional
Biometric information	Genetic, physiological, behavioural and biological characteristics, or activity patterns used to extract a template or other identify or identifying information, such as, fingerprints, faceprints and voiceprints, iris or retina scans, keystroke, gait or other physical pattern, and sleep, health or exercise data	No
Internet or other similar network activity	Type of device you use to connect to our website, unique device identifier (for example, a mobile phone number used by a mobile device), network information, your operating system and platform, your device’s browser type and version, your time zone setting, browser plug-in types and versions, your device’s current location based on your IP address, details of your use of or visits to our website, including your various interactions with our website pages and links, your preferences in receiving marketing from us and our third parties and your related communication preferences, your website preferences, feedback and survey responses, details of queries or support requests regarding the website or the services	Yes
Geolocation Data	Your device’s current location when you access our website, based on your IP address	Yes
Sensory Data	Audio, electronic, visual, thermal, olfactory or similar information	No
Professional or employment-related information	Current or past job history or performance evaluations	Yes
Non-public education information (per the Family Educational Rights & Privacy Act (20 U.S.C Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information or student disciplinary records	No
Inferences drawn from other personal information	A profile reflecting your preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities and aptitudes	No

We collect and use this personal information for the business and commercial purposes set out in the Personal Data Collected and Use of Personal Data sections above.

We do not sell your personal information.

Your Rights Under California Law

The CCPA provides California residents with rights regarding their personal information, such as access to information, data portability and deletion rights. This section describes available CCPA rights and explains how to exercise those rights in relation to the personal data that we collect about you (subject to certain legal limitations). You may request the following from us:

The categories of personal data we have collected about you;
The categories of sources of the personal data we have collected about you;
The specific pieces of personal data we have collected about you;
The categories of personal data that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
The categories of personal data we have sold about you (if any), and the categories of third parties to whom this information was sold;
The business or commercial purposes for collecting, or if applicable, selling the personal information;
Data rectification (to have inaccurate or incomplete personal information about you rectified); and
Data limitation (to limit use and disclosure of sensitive personal information, in some circumstances).

You also have the right to request that we delete any of your personal data that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete your personal data from our records unless an exception applies.

If you would like to make a request and exercise your rights, you may contact the applicable Vertex affiliate using any of the options below:

Privacy Rights Request Form

The Office of the General Counsel
Vertex, Inc.
2301 Renaissance Blvd.
King of Prussia, PA 19406
USA

844-321-3346

Legal@VertexInc.com

Only you, or someone legally authorised to act on your behalf, may make a verifiable consumer request related to your personal data. The verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information (or such person’s authorised representative) and describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it. We will only use personal data provided in a verifiable request to verify the requestor’s identity or authority to make the request.

We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm that the personal data relates to you.

Personal Information Sales Opt-Out and Opt-In Rights: We do not sell personal data to third parties.

Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. However, in some cases our ability to process personal data may be limited by your exercise of one or more of these rights (like a deletion request), which may mean that we are no longer able to provide the services or engage with you in the same manner prior to you exercising your right.

VII. Links to Third-Party Websites

This privacy notice only applies to Vertex websites and other online services that link to this privacy notice. However, our websites and other online services may contain links to third-party sites or services (for example, websites relating to industry trade shows and conferences). We do not endorse and are not responsible for the content of third-party websites or resources, and our privacy notice does not apply to any sites that are not controlled by Vertex, even if you access such sites via a link on our websites and other online services. You should review the privacy policies and terms of use of any third-party site before providing any information to the controller of such site.

VIII. How to Contact Us

The Office of the General Counsel
Vertex. Inc.
2301 Renaissance Blvd.
King of Prussia, PA 19406
USA

Legal@VertexInc.com

844-321-3346

Privacy Rights Request Form

IX. Changes to Our Privacy Notice

Vertex reserves the right to amend this privacy notice at our discretion and at any time. When changes are made to this privacy notice, the updated notice will be posted on our website or other applicable services, and will be effective as of the date posted. Your continued use of our websites and other online services following the posting of changes will constitute your acceptance of such changes. Material revisions to this privacy notice will not be applied retroactively without your affirmative consent.

Learn about our Terms of Use.