Website Privacy Policy

This Website Privacy Policy describes the information practices, policies and procedures of Kyriba Corp. and our affiliates and subsidiaries, Kyriba SAS, Kyriba SEMEA SAS, Kyriba UK Ltd., Kyriba HK Limited, Kyriba (Chongqing) Software Development Ltd., Kyriba SEA PTE. Ltd., Kyriba Japan, Co., Ltd., Kyriba Middle East FZ-LLC, Kyriba Software Technology (Shanghai) Limited, Rim Tec Inc., Fireapps GmbH, and Fireapps UK Ltd. (collectively “Kyriba” or “we” or “us” or “our”) with regard to our websites and other public-facing online services, including without limitation www.kyriba.com (collectively, the “Websites”). We understand your concerns about privacy and your interest in knowing how your information is used and safeguarded, and we want to provide you with more information on these topics.

Scope and Relation to Other Policies

This Privacy Policy applies to the personal information we collect from our Websites’ visitors and supplements other Kyriba privacy policies, including our Cookie Policy. Please refer to the Technology Platform Privacy Notice for information on the privacy policy applicable to the Kyriba SaaS Services. If you are a job applicant or a candidate for a position at Kyriba, please refer to the Candidate Privacy Policy.

You may have additional rights available to you based on your applicable location. Notice of your additional rights are available for your review by clicking on your applicable location on the left of the screen: California, Canada, Japan, Mexico or Singapore.

Personal Information We Collect

We may collect information that describes or relates to you (“personal information”). To the extent permitted under applicable laws, personal information does not include:

• Publicly available information as defined under applicable laws.
• De-identified or aggregated information.

Where required by applicable law, we will obtain your consent for the collection, use and/or disclosure of your personal information.

You represent and warrant that you will only provide information and use the Websites acting in your capacity as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit or other legal entity, and that your communications and transactions with Kyriba occur solely within the context of Kyriba providing the Websites to the company, partnership, sole proprietorship, nonprofit or other legal entity that you represent.

A. Personal Information You Provide And How It Is Used

Certain services, requests and features proposed via our Websites as listed below do require that you voluntarily provide us with some personal information (including, but not limited to, name, postal address, email address); availing yourself of any of these services, requests and features is voluntary.

Please note that we may use the personal information we collect, with your consent via the cookies banner, services, requests and features listed below. We collect this information for our business purposes, such as providing information, products and services, and our marketing activities (collectively “Business Purposes”).

Note: Please do not send company confidential or proprietary information to us directly through the Websites, or by email to any of the contact email addresses listed on the Websites.

Our Business Purposes may include:

• Webinars: If you opt to view one of our webinars, we will ask you to provide certain personal information, including your first and last name, email address, country of origin and phone number.
• Blogs: We provide you the ability to comment on our blogs. In order to leave a comment on one of our blogs, you will be required to provide your name and email address.
• Events: We provide information related to events that we periodically host. If you are interested in attending one of Kyriba’s events, we will ask you to provide an email address and other contact information that may be indicated on a case-by-case basis within the registration form so that we can reserve your seat and follow up with you.

• Email/Newsletters/Updates: When you register to get access to any of our resources, such as events or webinars, you may provide us your name, email, job title, and company name. This information may be used by Kyriba to contact you or update you on upcoming events, new developments or other Kyriba-related or partner-related information. You may unsubscribe from receiving all or some these updates at any time by using the “unsubscribe” link provided in any subsequent email you receive from us, or by emailing your request to [email protected].

• Contact Us: If you contact us via our Websites, we will ask that you provide certain personal information, including your first and last name, email address and country of origin, and you will have the option to provide additional personal information. We will use the personal information you provide to contact you and to respond to any requests.

B. Personal Information We Collect Automatically And How It Is Used

We or vendors on our behalf also collect, with your consent via the cookies banner, certain information by automated means as further explained in our Cookie Policy. If you do not provide consent, we will use a limited amount of your personal information for the legitimate interest of optimizing content, monitoring website traffic and ensuring website functionality.

How We May Disclose Your Personal Information

In certain situations, Kyriba may disclose personal information (described herein) that we collect, in accordance with our legitimate interests and business purposes as stated in this Privacy Policy and set forth below.

• Operating Services and Websites and Providing Related Support. To provide and operate our Websites and Services, communicate with you about your use of the Websites and Services, provide troubleshooting and technical support, respond to your inquiries, fulfill your orders and requests, communicate with you, and for similar service and support purposes.
• Marketing. We may disclose your personal information to third-party ad networks to serve advertisements on our Websites or other media. This enables us and other third parties to target advertisements to you for products and services in which you might be interested. We may also disclose personal information to partners, such as resellers and marketing providers, to identify prospects and share information about upcoming events and developments.
• Business Mergers or Acquisitions. If we or our affiliates are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. As part of the business transfer process, we may share certain of your personal information with lenders, auditors, and third-party advisors, including attorneys and consultants.
• In Response to Legal Process. We may disclose your personal information to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a court order or a subpoena.
• To Protect You, Us, and Others. We disclose your personal information when we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of this Policy, or as evidence in litigation in which we are involved.

We may disclose personal information to the following:

• Business Partners and Affiliates. We may disclose personal information to our subsidiaries, affiliates and channel partners such as resellers and co-sellers for business purposes. Those business purposes include identifying prospects and facilitating the ability of those entities to share information with existing and potential business customers regarding Kyriba upcoming events and other new developments.
• Service Providers. We may share personal information we collect with service providers who perform activities on our behalf, such as payment processing, data analytics, marketing and promotional services, website hosting and technical support. In accordance with applicable law, our service providers are required to take appropriate security measures to protect your personal information in line with our policies and are not permitted to use personal information for their own purposes.
• Third-party providers. We may disclose personal information to our third-party providers, such as our hosting or internet service providers, with whom we have contracted.

Children’s Privacy

Kyriba’s Websites, products and services are intended for a general audience and are not directed to children, including those under the age of sixteen (16). As such we do not knowingly collect, use, solicit or disclose personal information about children less than 16 years of age. If you are under the age of 16, we ask that you do not access the Websites. If you are the parent or guardian of a child under 16 years of age and believe that they have disclosed personal information to us, please contact us at [email protected].

Third Party Links

We may provide links to a variety of third-party social media sites and other websites as a service to you or in order to provide you additional information related to Kyriba or additional venues in which you can learn about and discuss Kyriba. Please note that we have no affiliation with these third parties, and we cannot control and are not responsible for the information collection, use, and disclosure practices of such third parties. We encourage you to review and understand their privacy practices and policies, if any, before providing any information to them. We are not responsible for the content or information of these websites, any products or services that may be offered through advertisers or third parties, or any other use of the linked website.

In some instances, it may look as though you are still on www.kyriba.com, however you may be on our third-party service providers domain. Their privacy policy applies to the collection and use of information when you are on such third-party domain.

How We Safeguard Your Information

We implement and maintain appropriate administrative, physical, and technical security safeguards to help protect the personal information we collect about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

Use of the Websites from Outside the United States

International Transfers

We do not represent or warrant that the Websites, or any part thereof, are appropriate or available for use in any particular geographic location. If you choose to access the Websites, you do so on your own initiative and at your own risk, and you are responsible for complying with all local laws, rules, and regulations applicable in your jurisdiction. Please note that the Websites are hosted in the United States and are governed by United States law. If you are visiting the Websites from outside the United States, please be aware that your information will be transferred to, stored and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States might not be as comprehensive as those in your country. By using the Websites, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share it as described in this Privacy Policy.

Transferring Personal Information Outside the Country of Origin

We are committed to ensuring all transfers of personal information, where applicable, is transferred in accordance with the laws applicable to Kyriba. If transferring data, Kyriba relies upon a variety of legal mechanisms, including Standard Contractual Clauses (including the UK addendum thereto), the European Commission’s adequacy decisions about certain countries, or the Information Commissioner’s Office adequacy decisions about certain countries, as applicable.

Data Controller

Data protection laws in Europe and the UK make a distinction between organizations that process personal information for their own purposes (known as “controllers”) and organizations that process personal information on behalf of other organizations (known as “processors”). Kyriba acts as a controller with respect to personal information collected as you interact with our Websites, emails, and advertisements.

Lawful Basis for Processing

Data protection laws in Europe and the UK require a “lawful basis” for processing personal information. Our lawful bases include where:

1. you have given consent to the processing for one or more specific purposes, either to us or to our service providers, which is applicable to all consent-based processing activities relating to this Policy, including those expressed in the Cookie policy;
2. processing is necessary for the performance of a contract with you or is necessary to take steps at your request prior to entering into a contract, which is applicable whenever you decide to use our business services or apply for a job position;
3. processing is necessary for compliance with a legal obligation; or
4. processing is necessary for the purposes of the legitimate interests pursued by Kyriba, which is applicable to activities like monitoring website traffic or displaying marketing content.

Your European Privacy Rights

Upon request, Kyriba will provide you with information about the processing of your personal information. To the extent required by law, we provide you with (i) reasonable access to the personal information you provide to us, (ii) the ability to correct or rectify such personal information, (iii) the ability to delete such personal information, (iv) the right to data portability, and/or (vi) the ability to restrict and/or (vii) object to our processing of personal information we collected about you. If you believe that any of the personal information that you have submitted through the Websites is no longer accurate, or you wish to make any updates or changes, or rights requests, you may do so by emailing us at [email protected].

Upon appropriate request, we will endeavor to comply with your request without undue delay, and not to exceed one month after receiving such request. However, we reserve the right to use any information previously obtained to verify your identity. We may decline to process requests if we cannot verify your identity, for requests that are unreasonably repetitive, jeopardize the privacy of others, are impractical, or for which access is not permitted by local law. Please note we need to retain certain information for record-keeping purposes, and there may also be residual information that will be maintained in Kyriba’s archival/back-up systems in an encrypted file in accordance with Kyriba’s internal practices for the protection of Kyriba’s legal interests.

European Complaints

If you have a complaint about our use of your personal information or response to your requests regarding your personal information, you may submit a complaint to Kyriba at [email protected]. If you are not satisfied with the way your request has been processed, you may contact the data protection regulator in your jurisdiction.

Changes to Our Privacy Policy

We may update this Privacy Policy at any time to reflect changes to our information practices. If we make any material changes, we will notify you by means of a notice on this website when a change becomes effective or such other method as selected by Kyriba. We encourage you to periodically review this page for the latest information on our privacy practices.

Privacy Questions and Contacting Us

If you have any questions or concerns about our Privacy Policy or data practices, or our compliance with applicable law please contact us by email at [email protected] or by writing to:

Kyriba Corp.
4435 Eastgate Mall, Suite 200
San Diego, CA 92121

Kyriba SEMEA
247 Bureaux de la Colline
92210 Saint-Cloud CEDEX, France

Effective Date

This Privacy Policy was last updated and is effective as of April 28, 2023.

Additional Disclosures for California Residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively “CCPA”), California residents have the right to receive certain disclosures regarding our information practices related to “personal information.” For purposes of this Section entitled “Additional Disclosures for California Residents” the term “personal information” shall have the same meaning as is defined under the CCPA. To the extent you are a resident of California and we collect personal information subject to CCPA, the following applies.

What Personal Information We Collect

The following identifies the categories of personal information we collect (and have collected in the prior 12 months), as enumerated by the CCPA.

• Identifiers, such as your name, email address, and phone number.
• Such other information as may be set forth in the Cookie Policy.

For more information about the personal information, we collect and how we use or disclose it please refer to the sections above.

How Long We Retain Personal Information

We store your personal information for as long as needed, or permitted, based on the reason why we obtained it (consistent with applicable law). When deciding how long to keep your Personal Information, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period of time before we can delete them) or whether we have taken any legal positions that require data retention (e.g., issued any legal holds or otherwise need to preserve data).

Rather than delete your personal information, we may also deidentify it in accordance with the CCPA, by removing identifying details. If we deidentify any personal information, we will not attempt to reidentify it.

Your California Privacy Rights

If you are a California resident, you may have the following rights under the CCPA with respect to your personal information.

• Right to Know/Access. You have the right to request (subject to certain exemptions):
  • The categories of personal information we collected about you;
  • The sources from which we have collected that personal information;
  • Our business or commercial purpose for collecting, selling, or sharing that Personal Information;
  • The categories of third parties to whom we have disclosed that personal information; and
  • A copy of the specific pieces of personal information we have collected.
• Right to Correct. You have the right to request that we correct inaccuracies in your personal information.
• Right to Delete. Subject to certain exceptions, you have the right to request deletion of personal information that we have collected from you. Please note, Kyriba is not obligated to delete personal information that is necessary to provide services that you request or required to comply with applicable laws.
• Right to Opt-Out. Under the CCPA, California residents may have the right to opt-out of the “sale,” or “sharing,” of personal information. California CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation, we may “sell” or “share” (as defined by the CCPA), the following categories of personal information: Identifiers, and Internet or Other Electric Network Activity Information to third-party advertising networks, analytics providers, and social networks for purposes of marketing and advertising. We do not sell or share sensitive personal information, nor do we sell or share any personal information about individuals who we know are under sixteen (16) years old. To opt out from the sharing or sale of personal information, please click on the “Do Not Sell or Share My Personal Information” link on the bottom of the website homepage.
• Right to Limit Use and Disclosure. Subject to certain conditions and exceptions, you may have the right to limit the use and disclosure of “sensitive personal information,” as defined under the CPRA. However, we do not engage in activities triggering this right.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.

How To Exercise Your Privacy Rights

To exercise any of these rights, California residents may submit a request through our online form available at info.kyriba.com/ca-consumer-privacy-act-opt-out, call our toll free number at 844-845-7161, or email us at [email protected].

In the request, please include “California Privacy Rights Request” in the first line of the description, and specify which right you are seeking to exercise. We will confirm receipt of your request within 10 days. Kyriba will need to confirm your identity before fulfilling the request, so please provide us with your name, street address, city, state, and ZIP code. We may require additional information from you to help us verify your identity and process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may designate someone as an authorized agent to submit requests and act on your behalf. To do so, you must provide us with written permission to allow the authorized agent to act on your behalf. We may also ask you directly to verify that you have authorized your authorized agent to act on your behalf.

If personal information about you has been processed by us as a service provider on behalf of a customer and you wish to exercise any rights you have with such personal information, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer and will support them to the extent required by applicable law in responding to your request.

In addition, our Policy and your rights thereunder have been designed to be accessible for blind and visually-impaired users and to allow for user interaction on such web form. If you experience any difficulties accessing this information, please call our toll-free number at 844-845-7161, or email us at [email protected].

Notice of The Right to Opt-Out of Sale or Sharing

To the extent Kyriba sells your personal information as the term “sell” is defined under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information by us to third parties at any time. You may submit a request to opt-out by clicking Do Not Sell My Personal Information. You may also submit a request to opt-out by calling our toll-free number at 844-845-7161 or emailing us at [email protected].

Additional Disclosures for Canada

If you are accessing the Websites from Canada, you may have the following rights:

• Right to Access Personal Information: Subject to applicable exceptions, you have the right to request that Kyriba provide you with (a) access to your personal information that Kyriba has under its control; and (b) information about the ‎ways in which that personal information is being ‎used and a description of ‎the individuals and organizations to ‎whom that personal information has been ‎disclosed‎.
• Right to Correct Personal information: Kyriba will make reasonable efforts to ensure that your personal information is accurate, complete ‎‎and ‎up-to-date for the purposes for which it is to be used. In most cases, we will rely on you to ensure that ‎‎ personal information is ‎correct, accurate and complete.‎ You can question the accuracy and completeness of your personal information and request in writing ‎that it ‎be ‎amended as appropriate. If you reasonably demonstrate that Personal information is inaccurate or incomplete, we will update the Personal information as required. If a challenge regarding the accuracy of Personal information is not resolved to your ‎satisfaction, ‎‎we will make a note to the Personal information that the correction was ‎requested but not ‎‎made.‎
• Right to Withdraw Consent: Applicable law may permit Kyriba to collect and Process your Personal information without consent. To the extent that Kyriba relies on your consent to collect or Process your Personal information, you have the right to withdraw your consent at any time. In this case, your withdrawal may have an impact on Kyriba’s ‎ability to manage various ongoing aspects of its relationship with you.‎

Data Transfers to Third Parties

We may share your personal information with third parties for processing, as described in the Privacy Policy, which may be located outside of Canada. Applicable ‎‎laws in ‎the applicable jurisdictions might permit foreign governments, courts, law enforcement or ‎‎regulatory ‎agencies to ‎access the personal information in those jurisdictions.‎ In these cases, Kyriba will comply with local ‎law requirements relating to the conditions for disclosure of personal information outside of your ‎jurisdiction. ‎We may also disclose your personal information without your consent if authorized or required by law.‎

Questions of Complaints

Kyriba has designated Erin Doyle Toburen, Sr. Legal Counsel, and the Kyriba Privacy Office as the persons responsible for the protection of personal information matters within the Province of Quebec, who may be contacted at [email protected].

If you have any questions or complaints regarding this Privacy Policy or Kyriba’s privacy practices, please contact Kyriba at [email protected].

Additional Disclosures for Japan

If you are accessing this website from Japan, you may have the following rights under the Act on the Protection of Personal Information (“APPI”):

Joint Use Notice

Your personal information may be jointly used within Kyriba Corp. and its affiliates to achieve the purposes described in this Privacy Policy. Kyriba Corp. will be responsible for management of the jointly used personal information.

Your Data Subject Rights

In Japan, you may also have additional rights under the APPI:

• The right to request deletion of or cessation of processing of your personal information if your personal information has been used beyond the scope necessary to achieve the purpose for which it was collected, processed or obtained by deceit or in violation of the APPI, if our use of your personal information triggers illegal acts, are no longer necessary in relation to the purposes for which they were collected, compromised or otherwise processed in a manner which could harm the rights or legitimate interest of you.
• The right to request cessation of transferring of your personal information if your personal information is transferred to a third party in violation of APPI or the transfer could harm your rights or legitimate interest.
• The right to request to disclose the following information (we may refuse your request to the extent we are permitted to do so in accordance with APPI):
  • The right to request information about data security measures we have implemented; and
  • In case where your personal information has been shared with foreign companies you may request information about, (i) the measures to ensure the data recipients take sufficient data security measures (the “Measures”) and the details of the Measures, (ii) measures and frequency that we audit the data recipients’ implementation of the Measures, (iii) name of the recipient country and rules of the country that could hinder the implementation of the Measures and (iv) other obstacles that could hinder the implementation of the Measures and measures that we have conducted to solve such obstacles.

International Processsing

If you are a resident of Japan, your personal information may be shared with the entities described in the Privacy Policy. If those recipient entities are outside of Japan, we will use reasonable endeavors to require such recipients to protect it in a way that provides comparable safeguards to those under the APPI, such as via contractual data protection obligations or because the recipient is subject to laws of another country with comparable protections. Specifically, we take “Equivalent Action” specified under Article 28.1 of the APPI to protect your personal information transferred outside of Japan.

Additional Disclosures for Mexico

If you are accessing the website from Mexico, then you may have the following rights:

Revoking Consent for the Processing of Your Personal Data

This Section provides additional information for Mexico residents that may be available to you under the Mexican Federal Law for the Protection of Personal Data in Possession of Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) (the “Mexican Privacy Law”).

You may revoke the consent that, where appropriate, you have given us for the processing of your Personal Data. However, it is important that you bear in mind that not in all cases we will be able to respond to your request or terminate the use immediately, since it is possible that due to some legal obligation, we will need to continue processing your Personal Data. Likewise, you should consider that, for certain purposes, the revocation of your consent will imply the termination of your relationship with us. The Data Controller has implemented a mechanism by which you can limit the use or disclosure of your Personal Data or revoke your consent for the processing of the same, by requesting via email to [email protected].

ARCO Rights

To the extent applicable under Mexican Privacy Law, you may have the right to: (i) access your personal information; (ii) rectify your personal information if it is inaccurate or incomplete; (iii) cancel your personal information; and (iv) oppose the use of the same for specific purposes (together, the “ARCO Rights”).

Should you wish to exercise any of the ARCO Rights, please send an email to [email protected]. The email must contain the following information at a minimum: (i) Full name and email or address, to communicate the response to your request; (ii) Documents that prove your identity, or where appropriate, that of your legal representative, (iii) A clear description of the Personal Data with respect to which you seek to exercise any of the ARCO Rights, and (iv) Any other document or description of the location of the personal information.

Kyriba may request additional information. Kyriba will respond to your request within twenty (20) business days, but, if applicable, such response may be extended by a maximum period of fifteen (15) business days.

Disagreeement or Complaint to the INAI

If you consider that your right to the protection of personal information has been harmed by any conduct or omission on the part of Kyriba, or you presume any violation of the provisions provided in the Mexican Privacy Laws, its Regulations and other applicable regulations, you may file your disagreement or Complaint before the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI). For more information, you may visit its official website: www.inai.org.mx.

Additional Disclosures for Singapore

If you are accessing this website from Singapore, you may, subject to requirements under applicable law, have the following rights in respect of your personal information:

• Right of access: You have the right to request access to your personal information as well as the right to request for information about how we have used or disclosed your personal information in the 12 months prior to your request;
• Right of correction: You have the right to request that we correct inaccuracies in your personal information;
• Right to withdraw consent: You have the right to withdraw your consent. Depending on the nature of the consent which is withdrawn, we may no longer be able to respond to your requests or provide you with certain services.

We may ask you for further information to verify your identity. We may also charge a reasonable fee for processing your access request. You can exercise these rights by emailing us at [email protected].