Outfit Privacy Notice

At Outfit, we understand that knowing how data about you (i.e., personal data) is used, shared, or otherwise processed by our organization is important to you. This Outfit Privacy Notice describes how we collect, use, and share personal data and explains your related rights and choices. "We" (or "Us") are On Brand Holdings Inc. ("Outfit") (including any relevant affiliates) and "You" may be a visitor to one of our websites, including outfit.io ("Sites"), or a user of our online services and applications ("Offerings").

Who We Are

Outit is an Australian-based software company offering a brand management, templating and creative automation platform with its main office located in Brisbane, Australia. You can learn more about us and our Offerings here.

Outfit may share personal data with our affiliated companies, including but not limited to Smartsheet Inc., Artefact Product Group LLC, Brandfolder, Inc., TernPro, Inc. (dba Slope), On Brand Australia PTY Ltd. (dba Outfit), On Brand Holdings Inc. (dba Outfit), On Brand Investments Ltd, (dba Outfit), On Brand Investments Pty. Ltd. (dba Outfit), Smartsheet UK Ltd. (fka Helpa Ltd. & Converse), Smartsheet Germany GmbH, Smartsheet Japan KK, Smartsheet Australia Pty Limited, and Smartsheet Costa Rica Limitada for our affiliates' internal business purposes (e.g., when you use or purchase an affiliate's services, when you apply to one of our global offices, etc.), marketing similar products, or for other legal requirements. A reference to "Outfit," "we," or "us" is a reference to Outfit and the relevant affiliate involved in the processing activity.

Scope

Outfit's Offerings permit users to automate the production of digital print materials, including marketing materials, with flexible constraints-based templates. This notice does not cover a customer's digital print materials, digital assets, or any other data that is uploaded or submitted to the Offerings by Customer (or its users) and is processed by Outfit on behalf of customer (collectively referred to herein as "Content"), nor does it cover the use of any third party integrations with the Offerings. Customers (and its users) control the nature of their Content and are the data controllers of their Content. We are a data processor of the Content, which means we only use or process it as directed by customers through their use of the Offerings and as otherwise allowed under the applicable underlying agreement governing a customer's use of the Offerings. If you are an existing Outfit Customer, please refer to the agreement that governs your use of the Services more information about how your Content is processed by Outfit.

We may engage third party service providers, under terms no less restrictive than those in the agreement governing Your access to and use of the Offerings, to process such content on our behalf or in connection with providing the Offerings.

Personal Data We Collect

We may collect personal data directly from you, from third parties or publicly available sources, or automatically when you use the Sites through the use of technologies such as electronic communication protocols, cookies, widget buttons, or tools. We collect this personal data for the purposes outlined below in “How We Use Personal Data.” This personal data is not Content.

How We Use Personal Data

We will only use your personal data if we have a lawful basis to do so. Specifically, we use your personal data at your instruction or as follows:

Providing and Personalizing our Sites and Offerings. To operate and administer the Sites and Offerings and to provide you with the content you choose to access or request; to tailor web content we display to you in order to offer location customization (e.g., setting a default language) and to otherwise personalize your experience using the Sites and Offerings. We may use cookies and similar tracking technologies to automatically collect your personal data for this purpose (see our Cookie Notice).

Provision of the Offerings. To provide and operate our Offerings, fulfill your orders and requests, process your payments or other Offerings-related transactions, notify you when you or others interact with you through an Offering, for bug and error reporting and resolution, to perform upgrades and maintenance, and for similar purposes. This may include the use of machine or deep learning technologies, as described in the Analytics and Improvement paragraph below.

Customer Support. To communicate with you about your use of the Offerings; to respond to your communications, complaints, and inquiries; to provide technical support; and for other customer service and support purposes.

Personalizing Events. To tailor event invitations we send or display to you in order to offer location customization (e.g., local event offerings). We may use cookies and similar tracking technologies to automatically collect your personal data for this purpose (see our Cookie Notice).

Identifying Customer Opportunities. To identify and assess potential new users through tools (e.g., LinkedIn) and to engage with individuals responding to web content produced by Outfit or otherwise available on the Sites. For current users to assess potential customer opportunities as they relate to engaging new users, meeting the demands of our customers, and enhancing particular users' experiences (e.g., engaging with customer user groups).

Sending Marketing Communications. For direct marketing, promotional, and other non-transactional communications (e.g., newsletters, calls, SMS, or push notifications) in order to share information about special offers, promotions, and events or to otherwise contact you about Outfit products or information we think may interest you, in accordance with your marketing preferences. This includes any fulfillment of your choice to opt out of receiving marketing or promotional communications altogether.

Offering Marketing Communications. For in-application marketing bulletins in order to share information about special offers, promotions, and events or to otherwise contact you about Outfit products or information we think may interest you, in accordance with your marketing preferences. This includes any fulfillment of your choice to opt out of receiving marketing or promotional communications altogether.

Displaying, Measuring Personalized Advertisements. To provide more relevant advertising to you on the Sites or third party platforms, or to conduct related marketing research (e.g., by measuring the success of targeted advertising campaigns). We may use cookies and similar tracking technologies to automatically collect your personal data for this purpose (see our Cookie Notice).

Managing Event Registrations and Contests. To plan and host events or webinars you've registered for or attend (including sending related communications to you), and to provide contests, promotions, and sweepstakes you've chosen to participate in or register for. Please note, contests may have additional rules relating to how we process your personal data.

Analytics and Improvement. To better understand how you access and use the Sites and Offerings, and for other research and analytical purposes, such as to evaluate and improve the Sites and to develop additional services, content, and features (e.g., if you choose to participate in a survey or user-interface study, we may use your email address to reach out with follow-up questions or additional studies). We may use machine or deep learning technologies for these purposes which may allow us to provide users with predictive tips and other features.

Protect Legal Rights and Prevent Misuse. To protect the Sites, Offerings, and the rights of users and other individuals; to prevent unauthorized access and other misuse; and where we believe necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or violations of our terms of use or this notice. We may use machine or deep learning technologies for these purposes (e.g., for fraud prevention or detection).

Comply with Legal Obligations. To comply with the law or legal proceedings (e.g., we may disclose data in response to lawful requests by public authorities, including responding to national security or law enforcement requests).

General Business Operations. Where necessary to the administration of our general business, accounting, recordkeeping, and legal functions.

Sharing of Data

We will not sell your personal data to a third party or allow a third party to use the personal data we provide for its own marketing purposes. We may share information about you with your consent, at your request, or as follows:

To Our Service Providers. We use third party service providers to process your personal data to assist us in business and technical operations. Outfit has agreements with such service providers limiting their use of and access to personal data to specific purposes. They provide services relating, but not limited to fraud detection and prevention, billing, customer support, internet and connectivity, marketing (through direct mail, email, lead generation, etc.), event organizing, security, and user experience.

To Infrastructure Processors. We use third parties for some of the infrastructure used to host content and personal data we process, including cloud providers. Outfit has agreements with such service providers and their use of and access to personal data is limited to specific purposes.

To Affiliates. We may share your personal data with our affiliates for our or our affiliates' internal business purposes (e.g., when you use or purchase an affiliate's services, when you apply to one of our global offices, etc.), marketing similar products (including lead generation and qualification purposes), or for other legal requirements.

As Custom Audiences. We may share a hashed (scrambled) version of your email address, name, city, state, or similar information with advertising partners to assist us in reaching you with more relevant advertisements outside of the Sites (and to measure the success of such campaigns). These partners are not permitted to retain, use, or disclose this information for their own third-party marketing purposes. If you would like to opt out of custom audiences, complete this form.

As Required by Law. We may disclose information about you if we believe we must do so to comply with the law or a subpoena, bankruptcy proceeding, or similar legal process. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

To Protect Rights. We may disclose information about you, such as your name, contact information, and billing information, to enforce our agreements with you or to protect the rights and safety of Outfit, our customers, our users, and the general public, or as evidence in litigation in which we are involved.

As Aggregate and Anonymized Information. We may share aggregate or anonymized information about you with our third party service providers for our internal business purposes which may include marketing, advertising, research, or similar purposes.

In a Business Transaction. If Outfit is involved in a dissolution, reorganization, financing, public offering of securities, merger, acquisition, or sale of all or a portion of its assets, your information may be transferred to providers, advisors, accountants, attorneys, the acquiring entity, or other third parties as part of the transaction (provided that we inform such individuals that they must use your personal data only for the purposes disclosed in this notice), and may also be reviewed as part of the due diligence review for the transaction (e.g., we may need to provide a list of all customer accounts and payment histories).

Your Marketing Choices

Marketing Communications. You can modify how we may contact you through email for marketing or promotional purposes at any time. This includes the choice to opt out of receiving emails from us for marketing or promotional purposes altogether. To modify how we may contact you through email, follow the instructions provided in the marketing emails we send or submit this form. Additional marketing or promotional preferences can be updated through the Offerings personal settings.

Custom Audiences. If you would prefer we do not include you in third party custom audiences, submit this form. Additional information relating to our use of custom audiences can be found in our Cookie Notice.

Cookies. Please visit our Cookie Notice to learn about and exercise your choices relating to cookies.

Your Rights

You may have certain rights relating to your personal data under local data protection laws (e.g., the General Data Protection Regulation, the California Consumer Privacy Act, etc.) or based on your use of our Offerings. Such rights may include:

Access

You can ask us to confirm if we are processing your personal data, provide you with details about such processing, and give you a copy of your personal data.

Erasure

You can ask us to erase your personal data if certain conditions are met. We are not required to comply with your request to erase your personal data if the processing of your personal data is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

Objection

You can object in writing to any processing of your personal data, which is done on the basis of our “legitimate interests,” if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you object in writing to our processing of your personal data, we shall then have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. In addition, you can object to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. We will then cease the processing of your personal data for direct marketing purposes.

Portability

You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it 'ported' directly to another data controller, but only where our processing is based on your consent and the processing is carried out by automated means.

Rectification

You can ask us to update or correct certain information; we may verify the accuracy of the data before rectifying it. For certain information you may be able to update or correct information by updating your personal setting within the Offerings.

Restriction

You can ask us to restrict (i.e., keep but not use) your personal data, but only where: its accuracy is contested (see "Rectification" above), to allow us to verify its accuracy; the processing is unlawful, but you do not want it erased; it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise, or defend legal claims; or you have exercised the right to object, and verification of any overriding grounds is pending. We can continue to use your personal data following a request for restriction where we have your consent to establish, exercise, or defend legal claims, or to protect the rights of another.

Withdrawal of Consent

You can withdraw your consent where processing is based on a consent you have previously provided. Your withdrawal of consent will not affect the lawfulness of the processing done prior to your withdrawal of consent taking effect. If you have questions about how to withdraw a consent you had provided, please complete this form.

Exercise of Rights

To exercise your rights, please contact us using this form or using the contact details provided under the "How to Contact Us" heading. We do not discriminate based on whether you choose to exercise your choices and rights and will not, based on your exercise of rights, deny the Offerings to you; charge you different rates (including through penalties or discounts/benefits); provide a different level or quality of Offerings; or suggest you may receive such different treatment. We will process any requests in accordance with applicable laws within a reasonable period of time. In order to properly process a request we may need to verify your identity before taking any request-related actions.

Personal Data Retention

We keep your personal data for as long as reasonably necessary for the purposes set out in our notices (see "How We Use Personal Data") or, if applicable, in accordance with the relevant terms in an agreement between you and Outfit. We will keep your personal data longer if required for tax or accounting purposes, to ensure we would be able to defend or raise a claim, to resolve disputes, enforce our contractual rights, or where we have a legitimate need - though we will generally not keep personal data for longer than seven years following the last date of communication with you. Where personal data is no longer required, we anonymize or dispose of it in a secure manner.

International Transfers

Outfit's primary processing activities are in the United States. Personal data we collect may be transferred to, used, and stored in the United States or other jurisdictions in which Outfit, our affiliates, or service providers are located; these locations (including the United States) may not guarantee the same level of protection of personal data as the one in which you live. By providing us with your personal data, you agree to such transfer and/or processing. Outfit assesses the circumstances involving all cross-border data transfers and has suitable safeguards in place to require that your personal data will remain protected in accordance with this notice. In the event of such a transfer, we ensure that: (i) the personal data is transferred to countries recognized as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as the applicable standard contractual clauses.

Children's Personal Data

Our Sites are not directed toward children under 18 and we do not knowingly collect personal data from minors. If you are under 18, please do not use the Sites or Offerings or share personal data with us. If you learn that anyone younger than 18 has unlawfully provided us personal data, please contact us.

Changes to this Notice

We may amend, update, or revise this notice from time to time to reflect changes to our privacy practices, changing technologies, industry practices, regulatory requirements, or for other reasons. If we make any material changes that affect the way we treat your data, we will notify you by email, through the Sites or Offerings, or by other legally acceptable means. We encourage you to periodically review this notice for the latest information on our privacy practices.

How to Contact Us

You have the right to complain to a data protection authority about our collection and use of your personal data, but we encourage you to reach out to us first. Where processing is undertaken by our affiliated companies, they are joint controllers with Outfit for your personal data. The best way to reach us is by filling out this form. Outfit's privacy counsel serves as Outfit data protection contact and can be reached at:

Webform: Contact privacy form

Email: privacy@outfit.io

Address: Attn: Legal - Privacy Office, 500 108th Ave NE, Suite 200, Bellevue, WA 98004 USA

Residents of the EEA. The controller of your personal data is Outfit.. Where processing is undertaken by our affiliated companies, they are joint controllers with Outfit for your personal data. You may contact Outfit's privacy counsel at privacy@outfit.io.