At Sideways 6, we treat your privacy seriously and will only use your personal information to provide the Sideways 6 idea management platform, administer your account, give you product support when needed, and improve your product experience. We encourage you to read this document thoroughly and contact us at privacy@sideways6.com in case of any queries or issues.

With respect to you as a data subject and user of the Sideways 6 platform, Sideways 6 Ltd acts as a data processor. We collect your personal data because we have been contracted by your employer, acting as the data controller in this case, to give you access to Sideways 6 and help your employer run innovation campaigns. We have not requested your consent to collect your data because you already gave consent to your employer for it to be collected and used in legitimate business interests, or processing your data in this way is necessary for the performance of your employment contract. This constitutes lawful basis for processing under the EU GDPR.

The personal information we collect from your Sideways 6 user profile is:

• Your company email address

• Your first and last names

• The profile picture you upload

• The IP address of the computer(s) you use to connect to Sideways 6

• Unique identifier in the form of a browser cookie

• The date and time of your first and latest login and activity

We also collect the information you and your employer’s other employees have given to your employer from your account on their Enterprise Social Network (Yammer, Workplace, etc.) and Azure Active Directory (if integrated):

• Your profile picture there

• Your company email address

• Your stated first and last names

• Your stated job title, department, and office location

• The link to your ESN user profile

• Any other personal data if revealed in employee posts on your ESN

The personal information we collect from other participants of innovation campaigns for ideas collected via emails or forms is:

• Company email address

• First and last names

We will hold on to this data for the duration of our engagement with your employer. Personal data of our clients’ employees is deleted within 30 days of the engagement being ended. We do not process or control any of your data belonging to special categories, like health information or religious and political views.

Your data is stored on Microsoft Azure servers and is always transferred securely, protecting you against data breaches and disruption. The location of these servers varies depending upon our agreement with your employer. If you are unsure as to which datacentres are being used for your data please contact your Customer Success Representative.

We use your information to:

• Set up your Sideways 6 account and continue to provide you access to the platform

• Authenticate you by using your company email address as an identifier

• Personalise your Sideways 6 experience by allowing you to save your preferences

• Carry out product satisfaction surveys to help us improve the platform

• Generate product usage analytics to help us improve your Sideways 6 experience

• Meet audit log requirements set out in our agreement with your employer

• Provide product support when requested and to notify you of any service disruption

• Give you updates about improvements made to the product via email or in-app

• Identify idea submitters and allow you to run ideas and innovation campaigns

• Send automated and manual communications to idea campaign participants

• Allow you to run analytics on the performance of idea campaigns

To further process your data, we use third party product support and analytics tools like Intercom to enable us to react to your questions and issues and continually improve the user experience. We host our platform and all data on third-party Microsoft Azure servers.

Your data may be viewed outside of the EU by employees of Sideways 6 and its subsidiaries in the process of providing product support. This data processing is contractually governed by the same data privacy guarantees outlined above. We may also use third parties located in countries considered to provide adequate data protection by the European Commission for processing your personal data, for example to send user administration and other communications.

Under the EU General Data Protection Regulation, you also have a right to:

• Be notified within 72 hours of a data beach concerning your data. We will notify your employer within 12 hours if we discover a data breach.

• Access what and how your personal data is being processed and request a copy. You can do this by contacting us at privacy@sideways6.com.

• Be forgotten if your data is no longer relevant to its original purpose. For such requests, contact your (former) employer or us at privacy@sideways6.com.

• Get a copy of your data that we store in a portable (easy to use elsewhere) format. We can provide a copy of your data in XLS format if you contact us at privacy@sideways6.com.

• Have a record of your personal data be corrected in case of errors or inaccuracies. To do this, contact Sideways 6 support or privacy@sideways6.com.

• Complain to the GDPR supervisory authority appointed by your member state if you believe your rights are being encroached.