CCPA Privacy Notice

Last Updated on February 13, 2024

CCPA Data Processing Addendum: CCPA Data Processing Addendum

DigitalOcean is complying with the California Consumer Privacy Act (“CCPA”) and considering its underlying principles in how we think about customer trust and data privacy as a core pillar of our business. We are providing this CCPA-specific privacy notice to supplement the information and disclosures already contained in our Privacy Policy. This notice applies to individuals residing in California from whom we collect Personal Information. The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and disclosure of information about them, as well as the rights to know/access, correct, and delete Personal Information.

Notice at Collection.

The chart below outlines the categories of Personal Information (which are defined by the CCPA, not us) that we have collected and/or disclosed for a business purpose in the preceding twelve months; the categories of sources of that information; whether we disclose, sell, or share that information to service providers or third parties, respectively; and the criteria we use to determine the retention period for such information. We collect this Personal Information for the purposes described below in “Use of Personal Information.” The examples are not meant to indicate what we actually collect or disclose. More information about our specific practices can be found in our Privacy Policy.

Category	We Collect	We Disclose	We Sell/Share	Sources of Personal Information
A. Identifiers	No	Yes	No	Third Parties
Examples: Name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
B. Categories of Personal Information in Cal. Civ. Code 1798.80(e)	Yes	Yes	No	DigitalOcean Customers
Examples: Name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
C. Characteristics of Protected Classifications under California or Federal Law	No	N/A	N/A	N/A
Examples: Race or color, ancestry or national origin, religion or creed, age (over 40), mental or physical disability, sex (including gender and pregnancy, childbirth, breastfeeding or related medical conditions), sexual orientation, gender identity or expression, medical condition, genetic information, marital status, military and veteran status.
D. Commercial Information	Yes	Yes	No	Third Parties
Examples: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric Information	No	N/A	N/A	N/A
Examples: Physiological, biological, or behavioral characteristics, including DNA, that can be used, singly or in combination with each other or with other identifying data, to establish individual identity, such as imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
F. Internet or Other Electronic Network Activity Information	Yes	Yes	No	DigitalOcean Customers/Third Parties
G. Geolocation Data	N/A	N/A	N/A	N/A
Example: Precise physical location.
H. Sensory Information	No	N/A	N/A	N/A
Examples: Audio, electronic, visual, thermal, olfactory, or similar information.
I. Professional or employment-related information	Yes	Yes	No	Job Applicant/Third Party
Examples: Job application or resume information, past and current job history, and job performance information.
J. Non-Public Education Information (as defined in 20 U.S.C. 1232g; 34 C.F.R. Part 99)	No	N/A	N/A	N/A
Examples: Records that are directly related to a student maintained by an educational agency or institution or by a party acting for the agency or institution.
K. Inferences Drawn from Personal Information	Yes	Yes	No	Third Parties
Examples: Consumer profiles reflecting a consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We determine the retention period for each of the categories of Personal Information listed above based on (1) the length of time we need to retain the information to achieve the business or commercial purposes for which it was collected, (2) any legal or regulatory requirements applicable to such information, (3) internal operational needs, and (4) any need for the information based on any actual or anticipated investigation or litigation.

Use of Personal Information

The CCPA defines various business and commercial purposes for collecting, using, and disclosing Personal Information. While we collect, use, and disclose Personal Information pursuant to our Privacy Policy as a whole, we wanted to clarify out that this includes Personal Information in accordance with the specific CCPA business and commercial purposes below:

Auditing related to a current interaction with you and concurrent transactions, including, but not limited to auditing compliance with this specification and other standards.
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
Debugging to identify and repair errors that impair existing intended functionality.
Short-term, transient use.
Contracting with service providers to perform services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
Undertaking internal research for technological development and demonstration.
Undertaking activities to verify or maintain the quality or safety of our services, and to improve, upgrade, or enhance our services.
Otherwise enabling or effecting, directly or indirectly, a commercial transaction.
For other purposes for which we provide specific notice at the time the information is collected.

Collection and Disclosure of Personal Information

In the preceding twelve months since this notice was last updated, we have collected Personal Information from general sources including you, your use of our services, your devices, our affiliates, our vendors, and our service providers. More specific information about Personal Information we collect is laid out in this notice and in our Privacy Policy, which we update from time to time.

As also explained in our Privacy Policy, we share your Personal Information with the following categories of CCPA third parties:

Affiliates.
Vendors and service providers, including for data analytics and marketing and advertising our products and services to you.
Third parties integrated into our services.
Third parties as required by law and similar disclosures.
Third parties in connection with a merger, sale, or asset transfer.
Other third parties for whom we have obtained your permission to disclose your Personal Information.

Your California Privacy Rights

If you are a California resident, you may exercise the following rights.

Right to Know and Access. You may submit a verifiable request for the: (1) categories of your Personal Information collected or disclosed by us; (2) purposes for which categories of your Personal Information are collected by us; (3) categories of sources from which we collect your Personal Information; (4) the categories of third parties and service providers to whom we sell, share, or disclose it; and (5) specific pieces of Personal Information we have collected about you.

Right to Correct. You also have the right to request in certain circumstances that we correct Personal Information that we have collected about you when that Personal Information is inaccurate.

Right to Delete. Subject to certain exceptions, you have the option to delete Personal Information about you that we have collected from you.

Verification. Requests for access to or correction or deletion of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested and pursuant to relevant CCPA requirements, limitations, and regulations. We verify your identity by asking you to provide billing information specific to your account that we can match against information that we may have collected about you previously.

Right to Equal Service and Price. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

Shine the Light. We do not rent, sell, or share your Personal Information with nonaffiliated companies for their direct marketing purposes, unless we have your permission.

Submit Requests. To exercise your rights under the CCPA, you can deactivate and purge your account in your control panel settings (https://cloud.digitalocean.com/settings). For other requests or to authorize an agent to make a request on your behalf, you can also reach out to us at privacy@digitalocean.com.

Contact Information

If you have any questions, comments, or concerns about our processing activities, or you would like to exercise your privacy rights, please email us at privacy@digitalocean.com or write to us at:

DigitalOcean 101 6th Ave New York, NY 10013 ATTN: Legal