Procore is a leading provider of cloud-based construction management software and related solutions, headquartered in California, United States, and with offices all around the world. Our mission is to connect people, applications, and devices to support the building of quality projects safely, on time, and within budget.

Procore values the protection of your privacy and maintaining your trust in our services. This Privacy Notice is intended to address the global privacy regulations applicable to the activities and services we perform.

Please be aware that data privacy laws can vary in the different jurisdictions where Procore operates. In some jurisdictions other federal, state, and/or local laws (collectively “Local Laws”) may also apply.

You may always contact us as described in the How to Contact Us section below if you have questions about this Privacy Notice, the processing of your Personal Data, or to exercise your rights as outlined below.

Scope

A reference to “Procore,” “we,” “us” or “Company” is a reference to Procore Technologies, Inc. and its relevant subsidiaries and affiliates involved in the collection, use, sharing, or other processing of Personal Data. A list of Procore’s affiliates can be found in the List of Subsidiaries section of Procore’s latest Form 10-K, available here.

This Privacy Notice describes how Procore uses and protects Personal Data collected for the following activities(“Activities”):

• visits to our websites such as: the Procore website; Procore Education websites Learn Procore and Education Procore; the Procore Community website; the Procore Marketplace; the Procore Developer Portal, Procore.org, ProcoreShop, Procore Construction Network, Levelset, and any other Procore websites on which this Privacy Notice appears ("Sites");

• engagement with Levelset, a Procore Company, lien rights solutions, materials financing solutions and other services (“LevelSet”);

• communications such as phone calls, text messages, emails, faxes, or video calls (“Communications”);

• site visits on project sites or Procore offices (“Site Visits”);

• registration and/or participation in our conferences and events (“Events”);

• registration and/or participation in our online products including learning and training programs, informative downloads, the Procore Construction Network and community services such as blogs, forums, and Procore story highlights (“Services”);

• participation in surveys or research initiatives (“Research”);

• visits to our branded social media pages (“Social Media”);

• and use of our products and services where we act as a controller of your Personal Data, including trial access to our Services and Procore Platform (“Direct Sales”).

This Privacy Notice also explains our marketing practices generally. Please note, depending on how you interact or engage with us we may provide you with other privacy notices that include additional details about our information practices. For example, this Privacy Notice does not apply to job applicants and candidates who apply for employment with us, or to employees in the context of the employment relationship, which are subject to other notices.

If you are a California resident, for more information about your privacy rights, please see the section of this Privacy Notice called “California Privacy Rights.”

Procore Platform

This Privacy Notice may apply to portions of Procore’s software-as-a-service products where you engage with Procore via our Sites, Services, or Direct Sales, including licensed software available through our platform via https://app.procore.com, and any software, mobile applications, products, devices, or other services (collectively "Procore Platform").

This Privacy Notice does not apply to the extent we process Personal Data while acting as a processor or service provider on behalf of a customer; under such circumstances we only process Personal Data on behalf of and in accordance with the instructions from our customer and any related data processing agreements, subscription service agreements, purchase orders, statements of work, or other applicable agreements. The privacy practices of our customers may differ from those explained in this Privacy Notice.

This Privacy Notice will apply to sections of the Procore Platform not specifically identified within an applicable agreement including trial subscriptions.

By using the Sites, Procore Platform, or otherwise providing your Personal Data through our Sites, LevelSet, Communications, Site Visits, Events, Services, Research, Social Media, and Direct Sales you agree that your Personal Data will be handled as described in this Privacy Notice and subject to any applicable terms of use.

What Is Personal Data

“Personal Data" means any data or information, in any form or medium, that on its own or when combined with other data could identify a particular individual, or any other data or information that constitutes personal data or personal information under applicable law. Personal Data does not include publicly available information, as defined by applicable law, de-identified information, or aggregated data.

What Personal Data We Collect

The following describes the categories of Personal Data we may collect from you.

Categories of Personal Data:

Personal Identifiers: such as name, alias, signature, postal address, phone numbers, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, national ID such as social security number, driver’s license number or state identification card number, and passport number.

Commercial information: such as records of personal property, products or services purchased, obtained, or considered; and other purchasing or consuming histories. We may also collect customer record information, such as billing or service address, insurance policy number, contracting contact information, and similar account details or any combination of the previously mentioned.

Protected Classifications: such as race, color, sex, sexual orientation, gender identity (including preferred pronouns), or other similar information.

Sensitive Personal Data: such as social security number, driver’s license number, or passport number, union membership, and Protected Classification data as described above.

Financial Information: such as payment history, bank account information, bank statements, tax information, credit or debit card number, other financial information for purposes of contracting, insurance, financing applications, or payments.

Internet and Network Activity Data (“Usage Data”): such as information required to provide access to Procore’s IT systems and networks, including IP addresses, log files, and login information, the type of Web browser you use; device type; your operating system; your web request; your Internet Service Provider and cookies; referring/exit pages and URLs; payload errors, the pages you view and how you interact with links; the time and duration of your visits to the Sites or use of the Procore Platform.

Geolocation Data: such as region, country, state, postal code, or location information we may derive from your IP address, event or visitor badging.

Audio, Visual, and Similar Information: such as CCTV footage, photographs, and audio/video recordings (e.g., recorded meetings and webinars).

Professional Information: such as professional or employment-related information such as current and former employer(s) and position(s), office location, business contact information, professional memberships.

Educational Information: such as information about Procore certifications or training, licensing, or education history.

Inferences: such as inferences drawn from any of the information identified above, such as a summary of financial performance for financing and insurance as necessary as well as usage history of Procore Sites and predictions about consumer preferences.

Where we Collect Personal Data

Most often, the Personal Data we collect about you is collected from you directly. In some cases, we may collect Personal Data automatically when you engage with Sites, Services, networks, and technology resources. Procore may also collect Personal Data through our services providers, as further described below.

Categories of Sources:

You: We may collect Personal Data directly from you when you engage with the Sites, set up accounts, sign up for or engage in any of our Services, register for Events, contact customer support via telephone or email, engage with Social Media, engage with our Services, conduct Site Visits, or otherwise contact us.

Other Sources: We may receive information about you from other sources, including your company, third parties, Procore customers or authorized users, referrals, or visitors. To the extent permitted by applicable law, we may combine this data with information we already have about you. If others give us your Personal Data, we will only use that Personal Data for the purpose of providing, supporting, and improving Procore services and other purposes that are compatible with the specific reason for which it was provided to us ( for example, as part of a referral or marketing campaign). Examples of other sources include:

Affiliates or Subsidiaries: we may collect Personal Data about you from our affiliates or subsidiaries.

Procore Customers: we may collect Personal Data about you from our customers who you share your data with for purposes of the use of the Procore Platform.

Service Providers or Other Third Parties: we may collect Personal Data about you from Service Providers who provide services on our behalf, such as vendors that assist us with marketing efforts or that perform web hosting services, or from other third parties that provide data collection services.

Publicly Available Sources: we may collect Personal Data about you from publicly available sources such as social media (e.g., LinkedIn).

Automatically Collected Data: We automatically collect Usage Data regarding the actions you take on the Sites, Services, Direct Sales and the Procore Platform from your browser, device, or network activity. This type of data helps us understand trends in our users’ needs so we can better consider new features or otherwise tailor the Sites and Procore Platform.

Who We Share Your Personal Data With

Your Personal Data, such as your name or username, may be available to others, for example when you create a profile or submit public queries. This information may be accessed by users who use the Sites or Procore Platform and may be accessed by commercial search engines such as Google, Yahoo, and Bing to the extent that such engines are permitted to access the Sites or Procore Platform.

We take care to allow your Personal Data to be processed only by those who need access to perform their tasks and duties, to third parties or service providers that have a legitimate purpose for accessing it, and to those who you have provided consent to. As part of a multinational group with affiliates in several countries, Procore may use resources that are located outside of the country where you live.

When we disclose Personal Data to our service providers and third parties, we generally enter into agreements with such parties that obligate them to process the Personal Data in accordance with applicable law, contract terms, and our specific instructions.

Recipients with Whom We Disclose Personal Data

Affiliates and subsidiaries: We disclose your Personal Data with our global affiliates, subsidiaries, and agents of Procore as may be necessary to manage our working relationship with you and our customers.

Event sponsors: If you attend an event or webinar organized by us, we may disclose your Personal Data with sponsors of the event. If required by applicable law, you may consent to such sharing via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your Personal Data will be subject to the sponsors’ privacy statements. If you do not wish for your Personal Data to be shared by Procore, you may choose to not opt-in via event/webinar registration or elect to not have your badge scanned, or you can opt-out in accordance with Exercise Your Rights below.

Customers with whom you are affiliated: If you are granted access to our Services by a Procore customer, we may disclose your Personal Data with the customer responsible for your access to our Services to the extent this is necessary for verifying accounts and activity; investigating suspicious activity; or enforcing our contract terms, terms of use, and policies.

Contest and promotion sponsors: With sponsors of contests or promotions for which you register in order to fulfill the contest or promotion.

Third party networks and websites: With third-party social media networks, advertising networks, and websites, so that Procore can market and advertise on third party platforms and websites.

Service Providers: We may disclose your Personal Data with service providers that process Personal Data on behalf of Procore to provide services (“Service Providers”). For example, we contract with Service Providers to provide certain services, such as hosting and maintenance, accounting, data analytics, and data storage and management, most of which are located in the United States. We only provide our Service Providers with the Personal Data necessary for them to perform these services on our behalf. Our Service Providers must generally agree to use reasonable security procedures and practices, appropriate to the nature of the information involved, to protect your Personal Data from unauthorized access, use, or disclosure. Service Providers are prohibited from using Personal Data other than as specified by Procore.

Contractors: We may make your Personal Data available to contracted entities and individuals for limited Procore business purposes. Contractors are contractually subject to data protection terms and requirements.

Regulatory and Government Entities: We may disclose your Personal Data with administrative, law enforcement, and regulatory agencies; tax authorities; corporate registries; and other public agencies or authorities. Procore will cooperate with government and law enforcement officials and private parties to enforce and comply with the law. We may disclose Personal Data and any other content and information about you to government or law enforcement officials or private parties, if necessary, in order to respond to legal requests (including court orders and subpoenas), to protect the safety, property, or rights of Procore or of any third party, to prevent or stop any illegal, unethical, or legally actionable activity, or to comply with the law.

Professional Services: In certain instances, we may disclose your Personal Data with professional advisers acting as service providers, processors, or joint controllers - including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services, and to the extent we are legally obliged to disclose or have a legitimate interest in disclosing your Personal Data.

Acquirer or Successor of Procore: Potential or actual buyers (and their representatives, agents, and advisers) in connection with any proposed purchase, merger, acquisition, reorganization, or other similar corporate event.

Partners: At your direction, we may disclose your Personal Data with integration partners, referral partners, reseller partners, and marketplace partners, with whom you interact via Procore.

Forums, Public Profiles, and Chat Rooms: Please be aware that whenever you disclose Personal Data on a publicly available page or any other public forum on the Sites or Procore Platform, others may access that Personal Data. In addition, please remember that when you disclose Personal Data in any other communications with third parties, that information may be passed along or made public by others. This means that anyone with access to such Personal Data can potentially use it for any purpose, including sending unsolicited communications.

How We Use Your Personal Data

We will normally collect Personal Data from you only where we have your consent to do so, where we need the Personal Data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you or may otherwise need the Personal Data to protect your vital interests or those of another person.

Our purposes for collection include:

Auditing: Verifying data and auditing compliance with technical and organizational standards.

Security: Helping to ensure network, physical, and information security.

Improvements: Debugging and errors analysis, crash reporting, and analytics to improve existing intended functionality of Sites and Services.

Notifications: Providing non-personalized advertising and notifications as part of interaction with Sites and Services, including the Procore Platform.

Provisioning the Activities: Performing or providing the Activities described above including maintaining or servicing accounts, profile management, providing customer service, processing or fulfilling orders and transactions, verifying information, processing payments, providing financing or insurance, certification and trainings from education tools, lien management, providing analytic services, providing storage, trial access, or providing functions.

Marketing and Engagement: Providing advertising and marketing services, event and newsletter subscription services, surveys, contests, other special offers, and Procore Stories (Customer highlighted stories and imagery).

Internal Research and Development: Providing internal research for technological development and market analysis.

Prevent Fraud: Detecting, investigating, and preventing fraudulent transactions and other illegal activities.

Corporate Governance: Reporting and adherence to corporate governance requirements

Legal Compliance: Providing legal or regulatory compliance, including reporting possible criminal acts or threats to public security to a competent authority, reporting to data protection authority, or applicable court order.

We may also collect and use data for carrying out any other limited purpose described to you at the time the information was collected.

The table below identifies the categories of Personal Data that we collect or may have collected in the previous 12 months, as well as the sources of data, the purposes for the collection, and any third parties with whom that data may be disclosed.

How We Use Usage Data

We may store Usage Data itself and such information may be included in databases owned and maintained by Procore affiliates, agents, service providers, or third-party advertising and analytics providers. We may use such information and pool it with other information, for example, to track the total number of visitors to our Sites or authorized users of the Procore Platform, or each page of our Sites, etc. We use this information to help us understand how people use the Sites and Procore Platform, support our advertising and marketing efforts, and to enhance our Services. If you complete a course offered on our Sites by a third party on a Procore Education site, we may share basic details (including which course, time spent, etc.) with that third party.

Our mobile application for the Procore Platform may collect certain additional information automatically, including the type of mobile device you use, your mobile device’s unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, available storage space, connection type (e.g., WiFi vs. cellular), and information about the way you use the application. We may also use GPS technology (or other similar technology) to determine your current location. If you do not want us to have your location information, you should turn off location services for the mobile application located in your account settings or in your mobile phone settings or within the mobile application.

We use mobile analytics software to allow us to better understand the functionality of our mobile software on your phone. This software may record information such as how often you use the application, the events that occur within the application, aggregated usage, performance data, and where the application was downloaded. We link certain information we store within the analytics software to authorized users for customer usage and metrics, and to aid in customer success.

Tracking Technologies

Cookies and Web Beacons: We may use cookies (a small text file placed on your computer to identify your computer and browser) and web beacons (a file placed on a website that monitors usage) to improve the experience of the Sites and Procore Platform, such as pre-populating your username for easier login, to allow user-specific messaging, or to permit user-specific advertising.

We classify cookies in the following categories:

• Strictly Necessary Cookies,

• Performance Cookies,

• Functional Cookies, and

• Targeting Cookies.

You can opt out of each cookie category (except strictly necessary cookies) by clicking on the “Cookie Settings” button below:

Cookie Settings

For more information on cookies, third-party cookies, and cookie management options, please see our Cookie Notice.

You can remove persistent cookies and change your privacy preferences by following directions provided in your Internet browser’s “help” directory, or by clicking the Cookie Settings button above. However, certain features of the Sites or Procore Platform may not work if you delete or disable cookies. Some of our service providers may use their own cookies and web beacons in connection with the services they perform on our behalf, as further explained below.

We and our partners use similar technologies to analyze trends, administer the website, track users’ movements around the website, and to gather demographic information about our user base as a whole. Users can control the use of cookies at the individual browser level.

Third-party Technologies: Third parties, such as ad servers, ad networks, and data exchanges (“Advertisers”) may place or recognize a unique cookie on your computer or use other technologies such as web beacons so that they can tailor their advertisements to your apparent interests and deliver those advertisements to you while you are on our Sites. In addition, Advertisers use technologies (such as cookies, pixels, and web beacons) to collect information about your browsing behavior on our Sites which they may match with information they have previously collected. Our Privacy Notice does not cover any use of information that Advertisers may collect from you or that you choose to provide to them. For information about how to opt out of receiving certain behavioral advertisements, please visit this website (or this one if located in the European Union). Please note this does not opt you out of being served ads, you will continue to receive generic ads. You may also continue to receive targeted ads on other websites, from companies that do not participate in the above programs.

Social Media Widgets: Our website includes social media features, such as the Facebook Like button, and widgets, such as the “Share this” button or interactive mini-programs that run on our website. These features may collect your Internet Protocol address, which page you are visiting on our website, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our website. Your interactions with these features are governed by the privacy statement of the company providing the features.

Children's Privacy

We do not knowingly collect Personal Data from children under the age of 13. If we become aware that we have inadvertently received Personal Data from a child under the age of 13, we will delete such information from our records.

Security

Procore implements appropriate physical, operational, and technical safeguards designed to help protect your Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to the Personal Data we collect or use. You can review our Security Measures page for more information about some of our security practices. We also contractually require that our Service Providers protect such information from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Please be aware that despite our efforts, no data security measures can guarantee security. As a result, while we strive to protect Personal Data transmitted on or through the Sites, we cannot and do not guarantee the security of any information you transmit on or through the Sites. Devise-users are responsible for the protection of personal devices and password credentials.

Procore also engages in a responsible disclosure program. The program invites you to help bolster existing security measures and adapt to the ever-changing threat environment. If you become aware of a vulnerability, please see our Reporting a Vulnerability page. If you become aware of an error in disclosure of any Personal Data, you may also email privacy@procore.com.

Data Retention

We will retain your information for as long as we have an ongoing business relationship with you or the business needs to do so (for example: to comply with applicable law, tax requirements, or enforce our agreements).

When we have no ongoing legitimate business need to process your Personal Data, we may either delete or de-identify it, or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is possible. If we collect or use de-identified information, we will not attempt to re-identify it.

Where We Process and Store Your Personal Data

From time to time, for the purposes described in this Privacy Notice, your Personal Data may be processed by us and our vendors outside your home jurisdiction, including in the U.S. and other countries. These countries may have data protection laws that are different from the laws of your country. Procore only transfers Personal Data to another country, including to its subsidiaries and other affiliates, in accordance with applicable data privacy laws, and provided there is adequate protection in place for the data. The relevant Data Controllers with respect to Procore’s Personal Data processing activities are:

We have taken reasonable measures to require that your Personal Data will remain protected in accordance with this Privacy Notice and applicable regulations. For more information about the subprocessors related to the Procore Platform, please see our subprocessor list at https://www.procore.com/legal/subprocessors.

Third Party Links

Our Sites and Procore Platform may contain links or integrate with other websites and online services or allow others to send you such links. Procore is not responsible or liable for any damage or loss related to your use of any third-party website or online service, including through the Procore Marketplace. You should always read the terms and conditions and Privacy Notice of a third-party website or online service before using it, whether directly or in connection with your use of the Sites or the Procore Platform.

Your Rights

You may opt not to disclose Personal Data to us, but keep in mind some Personal Data may be needed to register with us or to use some of our features. If we have collected and processed your Personal Data with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.

Please note that we may still use any aggregated and de-identified Personal Data that does not identify any individual and we may also retain and use your Personal Data As necessary to comply with our legal obligations, resolve disputes, or enforce our agreements.

You have several rights with respect to your Personal Data, as further described in this section.

How to Update and Access Your Personal Data

It is important that the Personal Data contained in our records is both accurate and current. We offer various self-help functions within our Site, tools, and Services that will allow you to update your Personal Data in our records. If we have Personal Data that you cannot access via these self-service systems, then you may make a request through the Privacy Team by email at privacy@procore.com or the Privacy Rights Request web form.

Depending on applicable Local Laws, you may have additional rights with regard to your Personal Data. Below is an explanation of your privacy rights. Please note, these rights do not conflict with any rights you may have under the applicable Local Law. Procore will not discriminate against you for exercising any of your privacy rights.

Data Subject Rights

Subject to conditions set forth in applicable data protection legislation, you may have the following rights:

• Right to Know/Be Informed - You have the right to know and understand what Personal data we collect and how we process it.

• Right to Access - You have the right to request access to any Personal Data concerning you, subject to limited exceptions that may be prescribed by applicable law.

• Right to Correct (Rectification) - Procore aims to ensure that all of your Personal Data is correct. You are entitled to have any inadequate, incomplete or incorrect Personal Data corrected (that is, rectified).

• Right to Withdraw Consent - In the event your Personal Data is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

• Right to Data Portability - Where we rely upon your consent as the legal basis for processing, or the fact that the processing is necessary to perform a contract to which you are party or to take steps at your request prior to entering a contract, and the Personal Data is processed by automated means, you have the right to receive all such Personal Data which you have provided to us in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

• Right to Erasure - You are entitled to have your Personal Data erased under specific circumstances, such as where you have withdrawn your consent, where you object to processing based on legitimate interests and we have no overriding legitimate grounds or where Personal Data is unlawfully processed.

• Right to Restriction of Processing (Limit Use and Disclosure) - You have the right to restrict our processing of your Personal Data under the below circumstances. Where your Personal Data is subject to restriction we will only process it with your consent or for the establishment, exercise or defense of legal claims.

  • you contest the accuracy of the Personal Data, until we have taken sufficient steps to correct or verify its accuracy;

  • where the processing is unlawful but you do not want us to erase the Personal Data;

  • where we no longer need your Personal Data for the purposes of the processing, but you require such Personal Data for the establishment, exercise or defense of legal claims; or

  • where you have objected to processing justified on legitimate interest grounds (see below), pending verification as to whether we have compelling legitimate grounds to continue processing.

• Right to object to processing justified on legitimate interest grounds - Where we are relying upon legitimate interest to process Personal Data, you may have the right to object to that processing based on grounds related to your particular situation. If you object, we must stop that processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or we need to process the Personal Data for the establishment, exercise or defense of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

• Right to lodge a complaint - You may lodge a complaint with the supervisory authority of your habitual residence, place of work or place of alleged infringement. Contact details for data protection authorities in the EEA, Switzerland, and certain other countries are available here.

Exercise your Rights

To obtain further information regarding your rights, to exercise any of your rights (other than to lodge a complaint), or to ask any questions regarding the processing of your Personal Data, please contact the Privacy Team by email at privacy@procore.com or the Privacy Rights Request web form.

Only you or someone legally authorized to act on your behalf may make a verifiable consumer request related to your Personal Data. You may also make a verifiable request on behalf of your minor child. You may designate someone as an authorized agent to submit requests and act on your behalf. We will respond to all requests in accordance with applicable laws. We may ask you for information to verify your identity and evaluate your privacy rights request.

Marketing Communications: You can opt out of receiving promotional or marketing communications from us at any time by using the unsubscribe link in the email communications we send or by filling out this Marketing Opt-Out Form. To opt out of non-email forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided in the How to Contact Us section below. If you set up an account on our Sites, we will still send you non-promotional communications like service-related emails.

You may also turn off push notifications on Procore Apps on your device.

If you want your phone number to be added to our internal Do-Not-Call telemarketing register, please contact us by using the information in the How to Contact Us section below. Please include your first name, last name, company and the phone number you wish to add to our Do-Not-Call register. Alternatively, you can always let us know during a telemarketing call that you do not want to be called again for marketing purposes.

Your rights where you have been granted access to the Procore Platform by a customer

As described above, we may also process Personal Data submitted by or for a customer. To this end, unless stated otherwise in this Privacy Notice or in a separate disclosure, we process such Personal Data as a processor/service provider on behalf of our customers. If your data has been submitted to us in our role as a processor/service provider and you wish to exercise any rights you may have under applicable data protection laws, please directly inquire with the customer that granted you access to the Procore Platform. Because we may only access a customer’s data upon their instructions, if you wish to make your request directly to us, please provide us with the name of the Procore customer(s) and project name(s) relevant to your request. We will refer your request to that customer, and will support them as needed in responding to your request.

Privacy Notice Changes

This Privacy Notice is reviewed and updated periodically to ensure it accurately describes our practices and procedures. We may also make updates or changes to this Privacy Notice because of changes in applicable laws or regulations. Any changes made to this Privacy Notice are effective as of the “Last Updated'' reference above. If necessary, we may take additional measures to inform you of changes, such as by posting a prominent notice on our Site.

Please print a copy of this Privacy Notice for your records.

How to Contact Us

If you have questions or concerns about our use of your Personal Data, please contact us at:

Procore Technologies, Inc.
6309 Carpinteria Avenue
Carpinteria, CA 93013 USA
privacy@procore.com

You may also contact us through our Privacy Rights Request Web Form.

Additional Local Law or Jurisdictional Specific Provisions/Disclosures

California Privacy Rights

This section of the notice provides additional information for California residents and describes our information practices pursuant to the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act 2020, and its implementing regulations ("CCPA").

The CCPA provides California residents with certain rights regarding their Personal Data. Please note, these rights only apply to Personal Data we collect and process under this Privacy Notice as a business/controller. For Personal Data we process on behalf of our customers in our capacity as a service provider/processor, please submit your request directly to the customer with whom you have a relationship, and we will provide reasonable assistance to that business client as necessary to enable them to respond to your requests to exercise your privacy rights. In general, California residents, including our customer’s employees who reside in California, have the following rights with respect to their Personal Data, subject to certain exceptions:

• Right to know/access: you have the right to request (subject to certain exemptions and exceptions):

  • The categories or Personal Data we collected about you;

  • The categories of sources from which the Personal Data is collected;

  • Our business or commercial purposes for collecting, selling, or sharing Personal Data;

  • The categories of third parties to whom we have disclosed Personal Data; and

  • A copy of the specific pieces of Personal Data we have collected about you.

• Right to delete: you have the right to request that we delete any of your Personal Data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your Verifiable Consumer Request we will delete (and direct our service providers to delete) your Personal Data from our records, unless an exception applies;

• Right to correct: you have the right to correct inaccurate information;

• Right to opt-out of sale and sharing: you have the right to opt-out of the “sale” or “sharing” of personal information, as these terms are defined under the CCPA. Procore does not sell Personal Data in the traditional sense (i.e., for money). However, the CCPA provides a broad understanding of “sale” and “sharing” which can include disclosing Personal Data for other, non-monetary benefits such as third-party data analytics and third-party advertising. As this new law is still evolving, and in the interest of transparency, Procore acknowledges that we may disclose or allow third parties to collect Personal Data (identifiers, and internet and network activity data) via tracking technologies on our Sites. We may also disclose contact information (identifiers) with event sponsors in the ways and purposes described above, including for advertising and marketing. To exercise your “opt out of sale” rights please click the Do Not Sell or Share My Personal Information link at the bottom of our Site, fill out the Procore Privacy Rights Request Web Form, or contact us at privacy@procore.com. You also have the right to opt-out of “sales” and “sharing” of your personal information through the use of an opt-out preference signal. If our Site detects that your browser or device is transmitting an opt-out preference signal from a “global privacy control” or “GPC” signal, we will opt that browser or device out of cookies on our Website that result in a “sale” or “sharing” of your personal information. To learn more about GPC signals and implementation, please see https://globalprivacycontrol.org. If you come to our Site from a different device or from a different browser on the same device, you will need to opt-out, or use an opt-out preference signal, for that browser and/or device as well. We do not sell or share Sensitive Personal Information, nor do we sell or share any Personal Data about individuals who we know are under sixteen (16) years old.

• Right to limit use/disclosure: you may have the right to limit the use and disclosure of Sensitive Personal Information.

• Right to non-discrimination: we will not discriminate against you for exercising any of the rights described in this section.

If you are a California resident and would like to exercise your CCPA rights, you may do so via any of the methods described below:

• Privacy Rights Request Webform

• Email us at privacy@procore.com

Before responding to your request, we must first verify your identity using the Personal Data you recently provided to us. You must provide us with our name, street address, city, state, zip code and an e-mail address or phone number. We will take steps to verify your request by matching the Personal Data provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

California Shine the Light Law

Procore does not disclose Personal Data to third parties for the third-parties’ direct marketing purposes, under Cal. Civ. Code §1798.83(d).

(EEA) and in the United Kingdom

Legal Basis for Processing Personal Data

If you are a visitor from the EEA, our legal basis for collecting and using Personal Data is described above in the How We Use Your Personal Data section above. If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Data, or for more details on our legitimate interests, please contact us using the contact details provided in the How to Contact Us section.

Rights

You have the following rights under the General Data Protection Regulation (GDPR) with respect to the information Procore is the controller:

• to access the Personal Data we maintain about you;

• to be provided with information about how we process your Personal Data;

• to correct your Personal Data;

• to have your Personal Data erased;

• to object to or restrict how we process your Personal Data; and

• to request your Personal Data to be transferred to a third party.

You also have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority. Contact details for data protection authorities in the EEA, Switzerland, and certain other countries (including the US) are available here.

International Transfers

We may share your Personal Data with colleagues within the Company in countries, including in the United States, which have not received a decision of the European Commission (or other relevant competent) confirming that it provides adequate protection to Personal Data and with third parties as described in this Privacy Notice.

Transfers outside the EEA and the UK may be made pursuant to approved Standard Contractual Clauses, Binding Corporate Rules, with your explicit consent, or other legally acceptable mechanisms that ensure an adequate level of protection. Where applicable, you are entitled, upon request sent to privacy@procore.com, to receive a copy of the relevant contract (such as Standard Contractual Clauses or Binding Corporate Rules) showing that appropriate safeguards have been taken to protect your Personal Data in connection with such transfer.

Privacy Shield

Procore Technologies complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States. Procore has certified to the U.S. Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/. Procore is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC for compliance with the Privacy Shield.

If you are a resident of the EU or Switzerland and are dissatisfied with the manner in which we have addressed your concerns about our privacy practices, you may seek further assistance, at no cost to you, from our designated Privacy Shield independent recourse mechanism: https://www.jamsadr.com/eu-us-privacy-shield.

Under certain conditions specified by the Privacy Shield Principles, you may also be able to invoke binding arbitration to resolve your complaint. For additional information, please visit Section C of Annex I to the Privacy Shield Principles found here: https://www.privacyshield.gov/article?id=ANNEX-I-introduction

Third Party Transfers

Procore may share data from EU residents with a third-party service provider that processes the data solely on Procore's behalf for the legitimate business purposes previously discussed. For onward transfers, Procore is responsible for processing personal information it receives under the Privacy Shield Framework. Procore may also disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have any questions or complaints about Procore’s privacy practices, including questions related to the Privacy Shield Principles, you may contact us via email at privacy@procore.com, or by mail at the addresses below, and we will work with you to resolve your issue:

Procore Technologies, Inc.

6309 Carpinteria Avenue

Carpinteria, CA 93013 USA

New Zealand

You have the right to ask for a copy of any Personal Data we hold about you as a controller, and to ask for it to be corrected if you think it is wrong. If you’d like to ask for a copy of your information, or to have it corrected, please contact us by email, web form, or mailing address found in the How to Contact Us section.

If we receive a request for access to Personal Data, we will respond within 20 working days of receiving a verifiable request. Our response may include a decision about whether we will be able to provide the requested information. We may be able to withhold information if:

• it is not readily retrievable;

• releasing it could negatively affect the requestor’s mental health;

• releasing it could put somebody else in danger;

• releasing it would breach someone else’s privacy;

• it was provided in confidence;

• we do not hold any Personal Data about the requestor;

• the request is trivial; or

• the request is vexatious.

Rights for Australian Citizens

The Australian Privacy Principles (“APPs”) set out in the Privacy Act provide you the right to request access to, and correction of, the Personal Data we hold about you by contacting us using the contact details set out in the Privacy Notice.