This Oracle Data Cloud Privacy Policy (also referred to as the ‘Privacy Policy’ or the ‘Marketing Cloud & Oracle Data Cloud Privacy Policy’) informs consumers (‘you’) on the collection, use, sharing, and selling (collectively referred to as ‘processing’ or ‘process’) of your personal information in connection with Oracle’s provision of marketing cloud and data cloud services designed to help Oracle’s customers’ and partners’ online and offline marketing activities (‘Oracle Marketing & Data Clouds’). This Privacy Policy also explains your privacy rights in relation to these processing activities.
This Privacy Policy was last updated on June 11, 2020. However, the Privacy Policy can change over time, for example to comply with legal requirements or to meet changing business needs. The most up-to-date version can be found on this website. In case there is an important change that we want to highlight to you, we will also inform you in another appropriate way (for example, via a pop-up notice or statement of changes on our website). View a previous version of this Privacy Policy.
As used in this Privacy Policy, ‘personal information’ or ‘personal data’ means information that relates to an identified individual or to an identifiable individual. For example, this could include among other things your name, address, email address, past purchase behavior or information regarding your online interests. Personal information about you that Oracle may process is also referred to as ‘information about you.’ For more detail about the types of information about you that we may process in the Oracle Marketing & Data Clouds, please refer to Section 4 below.
Find out what categories of personal information Oracle processes.
Find out how Oracle obtains your personal information.
Find out how Oracle uses personal information.
Find out how Oracle discloses personal information within Oracle and with third parties.
Exercise your privacy rights (opt-out, deletion, correction, or access) by filling out our inquiry form.
Contact the Global Data Protection Officer with any questions or concerns.
The Privacy Policy applies to Oracle’s processing of information about you provided to the Oracle Marketing & Data Cloud by our third party data suppliers to help enable Oracle Marketing & Data Cloud customers and partners to market products and services to you based on your interests.
The Privacy Policy does not apply to the following activities:
Oracle Corporation and Oracle America, Inc., having their registered address at 500 Oracle Parkway, Redwood Shores, CA, 94065, USA, are responsible for processing your personal information in scope of this Privacy Policy.
Information about you may in some cases directly identify you, while in other cases it may only indirectly identify you. Personal information that is collected offline and that can directly identify you may include, for example:
Personal information that is collected online and that may indirectly identify you may include, for example:
We may associate personal information about you with interest segments or profiles as part of the provision of Oracle Marketing & Data Cloud services to our customers and partners:
We use personal information for the following commercial purposes:
a) to help enable Oracle Marketing & Data Cloud customers and partners to market products and services to you based on your interests;
b) for personal information collected outside the EU/EEA, to analyze, develop, improve, and optimize the use, function and performance of Oracle products and services;
We use personal information for the following business purposes:
c) to manage the security of our sites, networks and systems;
d) to comply with applicable laws and regulations and to operate our business.
These purposes are described below in further detail.
We process personal information about you for marketing purposes to help enable Oracle Marketing & Data Cloud customers and partners to advertise products and services to you via online and offline marketing activities based on your interests. “Marketing purposes” means the processing of offline and online personal information, as defined in Section 4,: (i) to solicit or induce a purchase, rental, lease, or exchange of products or services directly to consumers or businesses via offline and online advertising campaigns; (ii) to develop market research or market surveys or to provide verification services to marketers; (iii) to create, communicate, deliver, and exchange offerings that have value for customers, clients, partners and society at large; or (iv) ) to encourage safe practices and trends and the provision of factual information, including, by way of example, providing product or automotive recall notices.
More specifically, Oracle can process information about you:
i. For online interest-based advertising delivered through Oracle Data Cloud partners that display online advertising to you on behalf of Oracle Data Cloud customers.
Example: a marketing professional working for a travel company wants to market the company’s travel specials to Hawaii to a specific group of individuals (also known as an audience) that may be interested in those specials. The marketing professional uses Oracle Data Cloud to create an audience interested in travel to Hawaii. If you have visited a travel website previously and have expressed an interest in Hawaiian vacations, you may be placed in the travel company’s audience and subsequently see advertisements for a vacation to Hawaii on other websites (because a cookie has been placed on your browser) or, In the United States, via a connected device (due to an association between your IP address and device identifier).
ii. For offline and online campaign measurement, analytics, and development of insights on behalf of our Oracle Data Cloud customers.
Example: a marketing professional working for a travel company wants to better understand if the company’s marketing campaign for travel specials to Hawaii contributed to an increase in their product sales. The marketing professional uses the Oracle Data Cloud to see how many display or videos ads were viewed, and whether the ads were clicked on and a purchase was made.
iii. For enabling our Oracle Data Cloud customers to personalize their products and services, including site optimization, email personalization and dynamic marketing and advertising optimization.
Example: if you have previously indicated an interest in travel to Hawaii and when you visit a travel company’s website, the travel company can display tailored offers for Hawaiian vacations on their homepage.
iv. For linking Profiles and Interest Segments to enable Oracle Marketing & Data Cloud customers and partners to connect your Interest Segments across the various browsers and/or devices you may use for the purposes described in this section.
Example: you are interested in vacations offered by a travel company and have clicked on their online advertising. You are logged into several devices (your desktop, smartphone, and tablet) using the same login. Oracle partners have indicated that you are likely the same user across those same devices. The travel company is able to display vacation offers to you (via a de-identified cookie ID) on these different devices.
v. For creating modelled online and offline audiences for Oracle Data Cloud customers’ products and services.
Example: a marketing professional working for a travel company wants to find new potential customers who are, like you, likely to be interested in travel to Hawaii. Oracle Data Cloud can help the travel company by looking for key characteristics between Profiles that have expressed an interest in traveling to Hawaii and other Profiles where a similar interest can be inferred based on these characteristics, such as an interest in travel to tropical islands.
vi. For enabling our Oracle Data Cloud customers to associate first-party information to certain Oracle Data Cloud identifiers in order to deliver marketing and advertising services to you.
Example: A travel company has its own lists of customers who have purchased travel arrangements with them, with names, emails, and addresses. The travel company wants to be able to reach out to these customers with online advertising. The Oracle Data Cloud can help the travel company by converting the company’s own customer lists from identified names, emails and addresses, to de-identified groups of cookie and device ID’s provided by the Oracle Data Cloud, in a process known in the advertising industry as “onboarding”.
vii. For the United States only: to allow our customers to deliver catalogues to your physical address that may be of interest to you based on your previous purchase behavior.
We may process personal information for Oracle’s own research and development purposes.
For example: to enhance data quality, develop new features and functionality, and for statistical analyses related to the performance and operation of the Oracle Marketing & Data Clouds.
We can collect usage and systems operations data from the Oracle Marketing & Data Cloud for security and operations management to help keep Oracle, customer, and partner networks and systems, as well as our products and services, secure. We may also collect usage and systems operations data to investigate and prevent cyber-attacks, malicious activity, or potential fraud, including ad fraud and to detect bots.
In some cases, we may process personal information to comply with applicable laws and regulations. For example, to respond to a request from a regulator or to defend a legal claim. We may also process personal information in the operation of our business. For example, to conduct audits and investigations, for finance and accounting, archiving and insurance purposes.
Oracle may process both offline and online information about you, including information from publicly available sources or third party data providers.
Our online Oracle Marketing & Data Cloud branded data partners are listed in our catalogue, which includes a comprehensive list of our current EU/EEA data suppliers. Please note that some of these partners only provide information about individuals in specific regions.
We rely on your consent for the purpose of enabling Oracle Marketing & Data Cloud customers and partners to market products and services to you, including measurement and analytics on campaign performance, personalization, modelling, onboarding, and linkage (see Section 5 above for additional details on these purposes). Your consent is obtained on behalf of Oracle and its Oracle Marketing & Data Cloud customers and partners by our third party data providers.
You have the right to withdraw your consent to this purpose at any time. Please refer to Section 13 below for more details on how to opt out of interest-based data processing based on your consent.
In addition, we may process some information about you as may be necessary based on our legitimate interest to maintain the security of our sites, networks, and systems, and to comply with applicable laws and regulations, such as to process an opt-out request.
Oracle maintains information about you for the following retention periods:
a) Online information about you is retained for up to 13 months.
Exceptionally and for online information collected outside the EU/EEA, online information may be retained up to 18 months, for example for Oracle customers’ seasonal or cyclical interest-based advertising campaigns or internal analytics and model development.
b) Online information about you for linkage purposes (cross device/cross-context technology) is retained for up to 12 months.
c) Offline information about you may be retained for up to 5 years if it was collected in the EU/EEA. We retain offline information about you in other regions as relevant for applicable purposes in those regions (also see Section 5 above).
d) Personal information necessary to preserve opt-out preferences is retained for 20 years, unless you delete it or otherwise prevent its collection as further described in Section 13 below.
As a global organization, information about you can be shared globally throughout Oracle’s worldwide organization for a business purpose. See a list of Oracle entities. Please select a region and country to view the registered address and contact details of the Oracle entity or entities located in each country.
Oracle employees are authorized to access personal information only to the extent necessary to serve the applicable purpose(s) and to perform their job functions.
We may share personal information with or sell personal information to the following third parties for a commercial purpose:
We may share personal information with the following third parties for a business purpose:
When third parties are given access to personal information, we will take appropriate contractual, technical and organizational measures designed to ensure that personal information is processed only to the extent that such processing is necessary, consistent with this Privacy Policy and in accordance with applicable law.
Oracle is a global corporation with operations in over 80 countries and personal information is processed globally. If personal information is transferred to an Oracle recipient in a country that does not provide an adequate level of protection for personal information, Oracle will take measures designed to adequately protect information about you, such as ensuring that such transfers are subject to the terms of the EU Model Clauses.
Oracle also complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention when an Oracle Data Cloud customer and Oracle have agreed by contract that transfers of personal information from the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”) will be transferred and processed pursuant to the Privacy Shield for the relevant services. When conducting those activities on behalf of its EEA, Swiss, or UK Oracle Data Cloud customers, Oracle holds and/or processes personal information provided by the EEA, Swiss, or UK customer at the direction of the customer. Oracle will then be responsible for ensuring that third parties acting as an agent on our behalf do the same. Oracle has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.
Please see the Privacy Shield website for the list of entities covered under Oracle’s Privacy Shield self-certification. With respect to personal information received or transferred pursuant to the Privacy Shield Framework, Oracle is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission and commits to cooperate with EU data protection authorities.
Oracle has implemented appropriate technical, physical and organizational measures designed to protect personal information against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access, as well as all other forms of unlawful processing.
Cookies and similar technologies (e.g., pixels tags and device identifiers) are used by Oracle and our advertising technology partners to recognize you and/or your device(s) on, off and across different services and devices for the purposes specified in Section 5 above.
Cookies are small text files that contain a string of characters and uniquely identify a browser on a connected device. We or our Oracle Marketing & Data Cloud partners may use cookies to, among other things, track user trends and collect information about how you use our customers’ sites or interact with advertising. Most browsers are initially configured to accept cookies by default. You may, however, be able to change your browser settings to cause your browser to refuse third-party cookies or to indicate when a third-party cookie is being sent. Check your browser’s “help” files to learn more about handling cookies.
Pixel Tags (also called web beacons or clear GIFs) are invisible 1 x 1 pixels that are placed on webpages that use this technology for marketing and measurement purposes. When you access these webpages, pixel tags generate a generic notice of the visit. Pixel tags can be used with cookies or alone. When used with cookies, pixel tags can track activity on a site by a particular device and provide relevant online advertising to you. When you turn off cookies or have opted out of cookies, pixel tags simply detect a unique website visit and how you interacted with the advertising but do not track an individual to provide relevant online advertising.
You can opt out of cookies using the opt-out tools in the next section.
Pursuant to the E.U. General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable laws and regulations, individuals in certain jurisdictions may have data subject rights enabling them to opt-out of third party sharing or selling, delete or remove, or request to access and receive a copy of their personal information in Oracle’s possession or for which Oracle is otherwise responsible.
Oracle offers multiple ways for you to opt out of third party sharing or selling and object to our use of information about you:
Please note that if you use this opt-out tool, Oracle will opt you out of Oracle’s use of information about you for Oracle Data Cloud services involving both first-party use of your information as well as any third-party sharing or selling of your information. See Section 2 above for more information on the distinction between first party and third party information.
The Oracle Data Cloud opt out will prevent Oracle from delivering third-party audiences to connected devices such as smart televisions or streaming device; however, you can also visit your device’s settings menu or privacy policy for information on how to opt-out directly with your connected devices.
Please note that if you opt out using any of the first three opt out tools, you may still temporarily see interest-based advertising from Oracle Marketing & Data Clouds customers due to advertising campaigns from those customers already underway. However, you will be opted-out of all future advertising campaigns from customers that use the Oracle Marketing & Data Clouds.
Also note that the first three opt out tools are currently cookie-based and prevent Oracle from using, sharing or selling your personal information for interest-based advertising on the browser on which they are installed. As a result, these opt out tools will only function if your browser is set to accept third-party cookies and may not function where cookies are sometimes automatically disabled or removed (e.g., certain mobile devices and operating systems). If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt out again. Oracle does not use persistent, unique identifiers to revive a previously opted-out profile or deleted cookie.
If you want to opt you out of Oracle’s use of information about you for Oracle Data Cloud services, but do not want to receive third-party cookies, you can also change your browser settings on your computer or other device you are using to connect to the internet. Most browsers also provide functionality that lets you opt out of all advertising cookies, including Oracle cookies.
You can erase or delete all online information about you by opting out of Oracle Data Cloud services using the Oracle Data Cloud opt-out toolabove.
If you would like to submit a request to have offline information about you, if any, erased or deleted, you can use this form.
In order to exercise your right to access your online information stored in the Oracle Marketing & Data Cloud, you can use the Oracle Data Cloud Registry (‘Registry’) to view the online segments Oracle has associated with your device. By accessing this Registry, you can view the types of third-party interest segments that are shared with or sold to Oracle Data Cloud customers. Please note that the interest segments you see within the Registry is information from the profile associated with the specific browser, computer or device that you are using to visit the Registry. You may see different segments when viewing the Registry from a different browser, computer or device. For a complete picture of the segments associated with all of your browsers and devices, we therefore recommend using these different browsers and devices when accessing the Registry.
To request access to your offline information, please visit the Oracle Data Cloud access site, available at https://datacloudoptout.oracle.com/request-your-data. While the majority of offline access requests can be handled quickly, complex requests may take more research and time. In such cases, you will be contacted regarding the nature of the request and appropriate next steps within 45 days from the date of receipt of your request. Upon visiting the Oracle Data Cloud access site, you will be asked to verify your identity to submit your request. If you cannot verify your request via the online portal, you can submit a written request via postal mail to the Oracle Global Data Protection Officer at the address below with a copy of a government-issued ID or other proof of identity for verification purposes. We cannot provide access to offline data unless Oracle can verify the identity of the individual making the request. The Oracle Data Cloud only processes offline data on residents within the United States.
We cannot provide offline first-party information that is collected and maintained by our customers. If you have questions in regards to first-party information, Oracle recommends that you contact directly the company that collected it from you.
We will respond to your request consistent with applicable law. Oracle will not discriminate against consumers who have exercised the deletion, opt-out, or access rights provided to them in this Privacy Policy.
Oracle does not create any online interest segments that reflect personal information that we consider sensitive. We also have operational procedures in our platform designed to prevent our partners and customers from using personal information provided to them by Oracle to create interest segments that we consider sensitive. While the types of personal information considered sensitive may vary among consumers and applicable law, we treat the following types of personal information as sensitive:
In addition, Oracle prohibits all segments in the EU/EEA, Switzerland and the UK that fall into any of the following categories: health/biometric/genetic, sex life or sexual orientation, race or ethnicity, religious /philosophical beliefs, political affiliations and opinions, any information related to children under sixteen, criminal offenses or convictions, or membership in a union. Similar or additional restrictions may apply in other regions.
We do not allow Oracle Marketing & Data Cloud customers or partners to use data provided to them by Oracle to make decisions related to an individual’s eligibility for employment, credit, healthcare, or insurance purposes or to make decisions solely by automatic means where the decision has a significant effect on the individual, or in any way that may or does discriminate against any person or promote bigotry, racism or harm.
We do not intentionally collect or share personal information of children under 16 years of age. Further, we prohibit our Oracle Data Cloud partners from providing Oracle with personal information from sites directed to children under the age of 16 or from consumers whose age these companies know to be under the age of 16.
Oracle is a member of, and adheres to, the self-regulatory principles of the following industry organizations:
As a member of these organizations, Oracle works with industry-leading companies to address important privacy and consumer protection issues in offline direct marketing and online advertising.
The NAI has created a compliance program that incorporates attestation reviews, a consumer complaint process, sanctions and annual reporting to help ensure that member companies keep their promises to you and abide by the NAI’s Self-Regulatory Code of Conduct.
If you are a California resident, you may request that we:
1. disclose to you the following information covering the 12 months preceding your request:
2. delete personal information we collected from you (see Section 13); or
3. opt-out of any future sale of personal information about you (see Section 13).
We will respond to your request consistent with applicable law.
If you are a California resident, you may obtain information about exercising your rights, as described above, by contacting us at 1-800-633-0748.
Oracle has appointed a Global Data Protection Officer. If you believe your personal information has been used in a way that is not consistent with the Privacy Policy or your choices, or if you have further questions, comments or suggestions related to this Privacy Policy, or if you wish to exercise your right to access to your offline personal information as described in Section 13 above, please contact the Global Data Protection Officer by filling out an inquiry form.
Written inquiries to the Data Protection Officer may be addressed to:
Oracle Corporation
Global Data Protection Officer
Willis Tower
233 South Wacker Drive
45th Floor
Chicago, IL 60606
U.S.A.
If you have any complaints regarding our compliance with this Privacy Policy, please contact us first. We will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with this Privacy Policy and in accordance with applicable law.
If you have an unresolved privacy or data use concern that you believe we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request. Under certain conditions, you may invoke binding arbitration when other dispute resolution procedures have been exhausted. You also have the right to file a complaint with a competent data protection authority if you are a resident of a European Union member state.
Oracle’s corporate headquarters are located at:
500 Oracle Parkway
Redwood Shores, CA
94065, USA
Tel: +1.650.506.7000
Fax: +1.650.506.7200
Previous versions: 12/24/19 | 07/26/19 | 01/17/19 | 05/25/18 | 02/13/18