Privacy Policy

MicroStrategy Privacy Policy

Effective April 4, 2024

We at MicroStrategy (hereinafter “we”, “us” and “our” for the purposes of this Privacy Policy) know you care about your privacy, and so do we. We have developed this Privacy Policy to describe the types of Personal Information we may collect, how we may use and share that information, our lawful basis for processing it, what rights you have in relation to your Personal Information and how we protect it. Please read this Privacy Policy carefully to understand how we will treat your Personal Information in connection with our applications, products/services, and/or websites (the “MicroStrategy Offerings”). We are not in the business of selling Personal Information about you to advertisers or spammers.

This Privacy Policy applies to processing undertaken where we (as the “controller” under applicable privacy law) are the organization which determines why and how your Personal Information is processed and is otherwise required under applicable law to provide notice of any processing undertaken.

“Personal Information” is any information that relates to you, and which, alone or in combination with other information, could reasonably be used to identify you. It does not include data where the identity has been removed (anonymous data).

We may make changes to this Privacy Policy from time to time, so please review it frequently. We will indicate at the top of the policy when it was most recently updated and, if the changes are significant, we will provide more prominent notice.

Our Services

In addition to, and included in, the MicroStrategy Offerings or on our website, MicroStrategy provides intelligent features (which include the MicroStrategy AI and Auto Expert applications), as part of a service that is hosted by MicroStrategy. If enabled by the user or our customer, MicroStrategy provides these intelligent features to recommend and/or provide targeted content regarding our products and services. These tools may use artificial intelligence, machine learning, or other technology to process your questions or queries. MicroStrategy’s intelligent features, including Auto, our AI assistant, exclusively rely on data from within the MicroStrategy Offerings. MicroStrategy does not use any of your inputs, chat history, or other communications to train MicroStrategy’s or third-party artificial intelligence models. Further, MicroStrategy intelligent features do not store or retain conversation histories past the active user session.

We may collect or receive Personal Information about you in various ways, depending on which of our applications and websites you use and how you interact with us, please see below for more information.

How We Collect Information

Information you provide to us

You may choose to submit Personal Information and other information to us by purchasing or interacting with the MicroStrategy Offerings. Examples of this include, when you create and manage a user account via our website, join or connect with a network, request technical support services, request information or support from us, communicate with us by email, telephone, or online chat, upload information through the MicroStrategy Offerings, subscribe to newsletters or other subscription services, register for training, educational programs, webinars or conferences, purchase products and services, submit job applications, request marketing to be sent to you, visit one of our sites, or participate in surveys.

For certain of the MicroStrategy Offerings or when you visit one of our sites, we may ask you to provide information including:

• Basic personal details (e.g., your name, title, and gender);
• Contact details (e.g., your corporate email address, postal address, including country and state, and phone number);
• Professional details (e.g., your job title, your company or organization name and any professional organization memberships);
• Usernames or URLs;
• Payment details (e.g., credit card information, bank account, etc.)
• Your photo (in connection with MicroStrategy World, events where you are a speaker or where you upload your photo in connection with Badge)and
• Any other Personal Information you choose to provide us (e.g., in communications with technical support services, marketing teams, or during the provision of products/services).

Some of the information is necessary for us to provide particular MicroStrategy Offerings, or for security clearance, and our ability to deliver the MicroStrategy Offerings or allow access to our site(s) may be affected by your not providing certain information.

Information that we collect

When you access or use MicroStrategy Offerings, we may also collect certain information about your device and your use of the MicroStrategy Offerings. Such information may include:

• information, including version information, about the web browser or application you are using;
• products/services you purchased, with related pricing;
• if you are using a mobile device, the model of the device and its operating system;
• crash data;
• a unique identifier we assign to you;
• your IP address;
• information about your usage of the MicroStrategy Offerings, including what functions or pages you use, the frequency of your use, links that you click on, and how often you log in;
• cookies (please see our Cookies Policy here); and
• video images and audio recording where you have interacted with us on Zoom.

For certain of the MicroStrategy Offerings, including MicroStrategy web or mobile applications, we do not collect any Personal Information about you. Please refer to specific application privacy practices posted on the relevant application webstores for a list of personal information each application may collect.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookies Policy.

Information We Collect From Other Sources

We may also collect these categories of information from sources other than directly from you. In particular, we collect this information from publicly available sources (such as your employer's website or professional social networks such as LinkedIn), and may obtain Personal Information from third party data. Other users of the MicroStrategy Offerings may provide information about you when they submit content through the MicroStrategy Offerings. For example, you may be mentioned in a technical support case opened by someone else. Similarly, an administrator may provide your Personal Information such as when they designate you as the billing or technical contact on your company's account. We may also receive information from analytics providers.

Please note that we may also have access to information about you that our customers may upload to our cloud services.

Location Information

To provide certain of the MicroStrategy Offerings, we may request your permission to access location information from your device. Some functions of the MicroStrategy Offerings may not work if you choose not to allow access to this location information. If you initially consent to sharing your location information through one of our applications or websites, you can subsequently stop the collection of this information by changing the settings of your device or by uninstalling the applications. Where you have not enabled location services for the applications or websites, we may derive general usage information (such as time zone) from your use of the applications or websites, including from your Bluetooth signal (where this is switched on when using Identity.

Video/ Audio

To provide certain of the MicroStrategy Offerings we employ the use of video conferencing services, which include the likes of companies such as Zoom, to interact with you and answer your queries or provide technical support. MicroStrategy may record this meeting and process some or all recorded data (including personal data) for provision of services, quality control, training purposes and to improve our services. Depending on your jurisdiction, we mainly rely on legitimate interest as our legal basis for processing.

This recording may include video images, and audio and written transcripts or summaries may be generated if certain features (e.g. Zoom AI Companion) have been enabled. Please note that when the recording sign is on (e.g. in Zoom (the red button)), the call is being recorded. In some instances, if it is required by applicable data protection law, we will obtain your explicit consent for video recording or use of AI features, which we will obtain at the point of collecting the data from you and which may be refused or revoked at any time.

Please see the Zoom Privacy Policy for more information on how Zoom works and processes Personal Information.

Our Lawful Bases for Processing

We will only process your Personal Information if we have a lawful basis for doing so. Lawful bases for processing include, depending on the applicable law, consent, contractual necessity, and our “legitimate interests” or the legitimate interest of others, as further described below.

Consent

Depending on your jurisdiction, some activities may require your consent, for example where we collect your personal data at events for our direct marketing communications so that we can provide further information and marketing to you. If applicable law requires your consent to process data in a certain way, then we will obtain it before carrying out that activity. When we process Personal Information based on your consent, it will be expressly indicated to you at the point and time of collection.

Where consent is not required, we will process your Personal Information because either it is necessary for our legitimate interests, is necessary to enable us to perform the contract or provide our services to you, or it is necessary for us to comply with our legal obligations.

Necessary to comply with a Legal/ Regulatory Obligation

From time to time, we may also need to process Personal Information to comply with a legal or regulatory obligation. We rely on this lawful basis when processing any data subject rights requests in accordance with applicable data protection laws and for activities relating to the prevention, detection and investigation of any crime. We also rely on it to comply with our financial reporting obligations and compliance with subpoenas or similar court orders.

Vital Interests/ tasks carried out in public interest

We may also need to process Personal Information if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.

Necessary to fulfill a contract

Other activities are carried out to fulfill a contract or agreement (for example, to comply with contractual obligations we have to you, including when we provide MicroStrategy Offerings to you in accordance with the applicable terms and conditions, or when we process payments and purchases you make). If a contract or account is in place, then we will process your Personal Information on the basis that it is necessary to perform our contractual commitments to you.

Legitimate Interests

In addition to the uses set out above, we may also process the Personal Information we collect for our legitimate business interests when that is an available legal basis under applicable law. “Legitimate Interests” means the interests of our company in conducting and managing our business to enable us to give you the best service and products and the most secure experience. For example, we have an interest in making sure our marketing is relevant for you, so we may process your information to send you marketing that is tailored to your interests. Our legitimate interests can also apply to processing that is in your interests as well. For example, we may process your information to ensure our websites and systems are secure. Specifically, we may also process the Personal Information we collect on the basis of the following legitimate business interests:

• where the processing enables us to enhance, modify, personalize or otherwise improve our services and communications for the benefit of our customers;
• to enhance the security of our network and information systems;
• to better understand how people interact with our websites;
• to review and update the information we hold on you, to ensure it is accurate and up to date;
• to assess your purchasing history and build a business profile on you (in your professional/business role);
• for analysis and research in connection with product offerings and development;
• promoting our products and services; and
• for direct marketing purposes (where this is permitted) and to determine the effectiveness of promotional campaigns and advertising.

When we process your personal information for our legitimate interests, we consider 3 questions: is there a legitimate interest behind the use of your Personal Information? Is our use necessary for that purpose and do your rights override our legitimate interest? We always keep your rights in high regard and we take steps to ensure your Personal Information is not used in ways other than those you would expect. We will not use your Personal Information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by applicable data protection law).

Where legitimate interest, or one of the other legal basis referred to above, isn’t available under applicable data protection law for the processing described under that subheading , then we will apply another alternative legal basis to enable us to carry out that data processing, or adjust the processing undertaken accordingly.

If you have any concerns about us using your Personal Information as outlined above, you have the right to object using the contact details contained in this Privacy Policy.

For California Residents and Residents of Certain Other U.S. States

The personal Information about you that we collect includes information within the below categories of data. These categories also represent the categories of Personal Information that we have collected over the past 12 months. Note that the categories listed below are defined by California state law. Inclusion of a category in the list below indicates only that, depending on the services and products we provide you, we may collect some information within that category. It does not necessarily mean that we collect all information listed in a particular category for all of our customers.

With the exception of recording of sales calls (and biometric information, which we do not collect or receive a copy of), we disclose the below categories of information with our affiliates and service providers.

We do not sell your Personal Information.  We also do not share your Personal Information for cross context behavioral advertising.

How We Use the Information We Collect

We may use the information we collect from you to:

• provide products/services to you;
• bill/invoice you;
• complete corporate transactions
• manage any accounts that you may have with us;
• validate your identity;
• send personalized marketing messages via email, post and telephone to you. Where required by applicable law, we will send these messages with your consent, and you have the right to opt out of receiving marketing by contacting us;
• serve relevant advertising on our site and third-party sites related to our products and services which are personalized to your interests;
• provide you with notice of product releases, special events, trainings, promotions or other matters relevant to you;
• respond to your inquiries;
• analyze how you are using, or interacting with, our products or services and to suggest and/or provide improvements or enhancements in the products or services you receive from us;
• solicit your feedback;
• prevent you from having to re-enter Personal Information about you on future visits to our websites or subsequent use of our applications;
• facilitate your access to third-party services and resources;
• keep track of your activities;
• process your payments and purchases;
• operate, evaluate and improve our business (including developing new products and services; enhancing and improving our services; managing our communications; analyzing our products; performing data analytics; and performing accounting, auditing and other internal functions);
• provide technical support/ answer your questions via Zoom calls;
• detect and prevent fraud and other unauthorized activity and enforce our terms of use; and
• comply with applicable legal requirements, relevant industry standards and our policies.

We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Our Marketing Activities

Where you have submitted your details on the MicroStrategy Website or at an event, webinar, via Zoom, or otherwise provided them to us so that we can provide you with further information about our products and services, we will only use the Personal Information you provide us for those purposes and, depending on your jurisdiction, in line with the consent we have obtained from you at the time.

We will communicate with you using the contact information provided (i.e. if you provide us your telephone number, we will call you, if you provide us your e-mail address, we will e-mail you), unless you have indicated a preferred method of contact, in which case we will follow that method of communication. Where we e-mail you with information about our products and services, we will provide you with a clear way to opt-out of receiving any further communications.

Please note, marketing communications are not the same as “information only”, or “service” or “transaction” communications where consents are not usually required for us to communicate with you about the services you have inquired about or have signed up to obtain through the MicroStrategy Website, using contact details you have provided for this purpose.

Where you no longer wish to receive emails that are marketing communications, you can unsubscribe at any point by contacting us using the contact details in the email sent to you or by using the contact details contained in this Privacy Policy. You can also opt out of receiving marketing communications from us by logging into our website and unchecking relevant boxes to adjust your marketing preferences in our preference center.

Please note, we are not responsible for any direct marketing sent to you by any third party in respect of which you have given your consent. In such instances, you should refer to the privacy policy of that third party. If you wish to unsubscribe you will need to contact them directly.

Data Enrichment & Profiling

We sometimes utilize third party business databases such as ZoomInfo or Lusha to keep our contact database up to date and accurate. We compare the data we hold about you as a business contact with data held by these third party business databases, and we update where necessary, for example by adding your new business address. This is known as ‘data enrichment’. Please note that we do not share or contribute any of your information to ZoomInfo or Lusha. For more information on ZoomInfo please see their Privacy Policy. For more information on Lusha, please see their Privacy Policy.

We use your information to build a business profile about you, in your professional/business capacity, for example by noting your purchase history, type of contract and product use/ feedback, and responses to our communications. We use this information in order to better assess your business needs and to understand what products within the MicroStrategy Offerings might be suitable for you in future, such as relevant upgrades. We may use such information to determine which marketing communications to send to you, and depending on your jurisdiction, where you have opted in to receive these.

With Whom We May Share Information

We disclose information about you:

i. to our third-party service providers, such as IT systems, network and back-up and storage;

ii. to other MicroStrategy group companies;

iii. resellers;

iv. system integrators;

v. co-sellers;

vi. referral partners;

vii. technology partners;

viii. professional advisors, such as lawyers, accountants, auditors and/or consultants; or

ix. government agencies, such as law enforcement authorities, or regulators.

We also reserve the right to transfer any information we have about you in connection with any sale or transfer of all or a portion of our business or assets, including in the event of a reorganization, dissolution or liquidation.

In addition, if you are using Identity, we may share certain of your information with the administrator of an Identity Network that you are a member of, with other users of the Identity application, or with third party services with which your Identity Badge is integrated.

Transfers of Personal Information Abroad

We take appropriate steps to protect your Personal Information regardless of where it is stored, taking into consideration the requirements of the data protection laws which we consider are applicable to how we process your Personal Information. These include entering into contracts with third parties. An example of this could arise if our processing of your Personal Information is protected under United Kingdom or European Union data protection laws. If that Personal Information will be transferred by us or on our instructions to a country outside the United Kingdom or European Economic Area and doing so would otherwise be restricted under prevailing data protection law applicable to us, because your Personal Information would not be protected to an equivalent data protection law standard, we will put in place an approved mechanism for providing appropriate safeguards to protect it. This includes approved mechanisms such as standard contractual clauses.

MicroStrategy’s U.S.-based entities, MicroStrategy Incorporated and MicroStrategy Services Corporation, participate in the EU-US Data Privacy Framework (DPF), the UK Extension to the EU-US DPF and the Swiss-US (DPF). We will comply with the principles of the DPF issued by the Department of Commerce, and we are subject to the investigatory and enforcement powers of the US Federal Trade Commission (FTC). Please see: https://dataprivacyframework.gov/s/participant-search.

MicroStrategy commits to resolve complaints about our collection or use of personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our DPF privacy policy should first contact MicroStrategy at privacy@microstrategy.com.

Additionally, an individual may be allowed to invoke binding arbitration to resolve disputes under certain limited conditions. MicroStrategy has further committed to refer unresolved DPF complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaints from us, or if we have not resolved your complaint, please contact or visit https://www.jamsadr.com/eu-us-data-privacy-framework for more information or to file a complaint. The services of JAMS are provided at no cost to you. In cases of onward transfers to third parties of personal data of EU individuals received pursuant to the DPF, MicroStrategy maintains contracts with these third parties limiting their access, use, and disclosure of personal data in compliance with our DPF obligations. To the extent provided by the DPF principles, MicroStrategy could be potentially liable if the third-party processes such personal data in a manner inconsistent with the DPF principles, unless MicroStrategy proves that it is not responsible for the event giving rise to the damage.

There may also be some instances in which we rely upon one or more permitted exceptions under the relevant data protection law for cross border transfers. For example, where we have asked for your explicit consent to do, or to perform a contract with you, or take steps prior to doing so, to conclude or perform a contract with another party concluded in your interest, for important reasons of public interest, or where it is done in the context of legal claims.

How We Protect Personal Information

We maintain appropriate administrative, technical and physical safeguards designed to protect the Personal Information you provide against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. We have put in place procedures to deal with any suspected breach of Personal Information and will notify you and any applicable regulator of a breach where we are legally required to do so.

How Long We Keep Personal Information

We also ensure that, in compliance with applicable law, we do not retain Personal Information longer than necessary. We will keep Personal Information about you for as long as we have a relationship with you, for example as long as you wish to keep receiving marketing messages from us, or as long as you are a customer (and for a reasonable period thereafter). When determining how long to retain Personal Information after we no longer have a relationship with you, we take into account how long our customers usually want to continue hearing from us, our legal obligations and the expectations of regulators, as well as the length of time information is needed for internal audit purposes and to exercise or defend our legal rights.

We also consider the amount, nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

This includes the following:

• Retention in case of queries - We may retain your Personal Information for a reasonable period in case of follow up queries from you.
• Retention in case of claims - We may retain your Personal Information for the period in which you might legally bring claims against us (this means we will retain it in line with relevant limitation periods, which are applicable to your jurisdiction, for example 7 years from the end of the contract, for information relating to contracts with us if based in the UK) if and to the extent this is relevant.
• Retention in accordance with legal and regulatory requirements - We will consider whether we need to retain your Personal Information after the period of retention in the case of queries or claims because of a legal or regulatory requirement.
• Retention permitted under applicable law - We will continue to retain Personal Information where necessary to provide our services to you and the retention of such Personal Information is necessary for the purposes of pursuing our legitimate interests or where it is necessary for public interest purposes.

We review our retention periods for Personal Information on a regular basis, and all data is retained in compliance with applicable data protection law. We will only permanently retain certain basic Personal Information, for limited purposes. This is in relation to retaining basic contact details, to keep a record that you were a customer, in case you return in future, or where you have asked us not to contact you again.

Links to Other Websites

The MicroStrategy Offerings may contain links to websites maintained by third parties, whose information and privacy practices differ from ours, including, for example, websites that process online payments. We are not responsible or liable for the content of any such websites, any use of such websites or the information or privacy practices employed by the providers of such websites. We encourage you to read the privacy statements of all third-party websites before using such websites or submitting any Personal Information or any other information on or through such websites.

Not for Use by Children

The Services and MicroStrategy Offerings are not directed to, and we do not knowingly contact or collect Personal Information from, individuals under the age of eighteen. If you are under the age of eighteen, these Services and Offerings are not intended for you and you should not provide us with any Personal Information.

Your Rights

Depending on your jurisdiction, you may be entitled to certain rights, which can include:

• Where our use of your Personal Information requires consent, you may withdraw this consent at any time;
• You may request access to your Personal Information we hold about you in a portable, and to the extent technically feasible, readily usable format, and to obtain information about how we process it. Depending on the applicable privacy laws (e.g. California law), you may be entitled to request the categories and specific pieces of Personal Information that we have collected about you, the categories of sources from which the Personal Information was collected, the purposes of collecting the Personal Information, the categories of third parties we have shared the Personal Information with, and the categories of Personal Information that have been shared with third parties for a business purpose;
• You may update, correct or amend the Personal Information we hold about you if it is wrong;
• You may ask us to change, restrict or stop the way in which we communicate with you or process Personal Information about you;
• You may ask us to delete your Personal Information;
• You have rights in relation to automated decision making, including profiling which has a legal effect, or which causes a significant effect;
• You may ask us to move, copy or transfer your Personal Information;
• You may object to our processing of your Personal Information; and
• You may opt out of the sale or sharing of Personal Information to third parties or for cross-context behavioral advertising—however, for purposes of U.S. state privacy law, we do not sell or share your Personal Information to third parties or for cross-context behavioral advertising (or for targeted advertising), nor do we intend to, as those terms are defined by applicable U.S. state privacy law. We also have not done so for the last 12 months. In addition, we have contracts with our service providers to prohibit any sale of the personal information we provide them; but if you have any concerns that our third parties might be selling your information, please contact us.

If you would like to exercise any of your rights or if you have any questions about this notice or would like to make a complaint please send an email to privacy@microstrategy.com that details your request and includes your exact name, physical address and email address. You may also submit a request to access or delete your information via our webform.

Please note that, where required by law, we may need to verify your identity when you request to exercise your privacy rights. To do so, we may ask you to confirm information we already have on file or provide such other proof as we need in order to determine and confirm your identity before responding to your request. Also, if you would like to authorize someone to make a request on your behalf, you must provide the agent with written, signed permission to submit privacy right requests on your behalf, or provide a letter from your attorney. The agent or attorney must provide this authorization at the time of request. Note that we may require you to verify your identity with us directly before we provide any requested information to your approved agent.

We will not discriminate against you in any way for exercising your rights.

You may have the right to appeal a denial of a rights request by contacting us at privacy@microstrategy.com. You may have the right to make a complaint at any time to your local data protection regulator. If you are based in the European Economic Area, you can access a list of these here. If you are based in the UK you can access contact details for the ICO here. We would, however, appreciate the chance to deal with your concerns before you approach your regulator or ICO so please contact us in the first instance.

Additional Information for residents of California and, where applicable, of Colorado. We will maintain all of your Consumer Data Rights requests for at least 2 years. This information will not be used or any other purpose except to review compliance processes; it will not be shared except as necessary to comply with a legal obligation. For residents of Colorado, to the extent Colorado law applies, any sensitive data which we no longer have consent to process will be deleted or rendered permanently anonymized or inaccessible within a reasonable period of rime after withdrawal of consent.

How to Contact Us

If you have any comments or inquiries about this Privacy Policy, if you would like to update information we have about you or to exercise your rights, you may contact us by submitting a Data Privacy Inquiry, sending an email to privacy@microstrategy.com or by sending regular mail to the following address:

Attn: Office of the General Counsel
MicroStrategy Incorporated
1850 Towers Crescent Plaza
Tysons Corner, Virginia 22182

If you are located in the E.U., you may also write to us at:

MicroStrategy Limited
Chiswick Park
Building 4, 3rd Floor
566 Chiswick High Road
Chiswick, London, W4 5YE
United Kingdom
Attn: Legal Department

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority in the country in which you live via their website.

Changes to this Policy

We may change this Policy from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. We will update the date at the top of the Privacy Policy accordingly. We encourage you to check this Policy for changes when you revisit the MicroStrategy website.