Last Edited on April 29, 2025.
General Scope
- Persons. This Privacy Notice applies to the processing of personal data (“data”, “personal data”, “personal information” “information”) related but not limited to:
- the visitors of our Website including our main Company page https://hex-rays.com/, our plug-in repository https://plugins.hex-rays.com/ (hereinafter "the Website"), our Company Social Media pages, and our Company Community Channel on Discourse (Community.hex-rays.com) and Slack
- the (prospective) customers (and personnel of the same) including through resellers for our own purpose, users and end-users of Hex-Rays products and services (including free products), training participants (including online conference)
- the (prospective) independent contractors/consultants, vendors, suppliers, service providers, partners including resellers, external trainers and the personnel of the same, events participants
- Hex-Rays job applicants
- Laws. Hex-Rays as the Controller hereinafter as “we” or “us”, responsible for the processing of your personal data, has committed to comply with:
-
- The General Data Protection Regulation N°EU 2016/679 (hereinafter, the "GDPR"),
- And all applicable laws and regulations regarding data protection and privacy,
collectively referred as "Data Protection Laws".
- Acknowledgment. With this Privacy Notice, Hex-Rays wants to make sure that you understand what personal information is collected about you, how your personal information is used and how it is kept safe. Access to the Website, Social Media pages, our Company Discourse Channel, our products and services, job positions, (pre)contractual relationship and any interactions with us/our products and services as a person described in the scope of this Notice implies your full and unreserved acceptance of this Privacy Notice (hereinafter the “Notice”), as well as the Cookies Notice when applicable. You acknowledge having read the information contained in those Notices. This Privacy Notice is effective as of the date stated at the top of this page. We may change this Notice from time to time. Please refer to this Notice on a regular basis. You are responsible to inform every natural person on behalf of which you are submitting data/engaging with us of the content of this Privacy Notice.
- Personal data submission and posts. When you communicate with us (including by filling in a webform, making a request) or post and interact on our (community) platforms including on our Company Discourse Channel: please refrain from providing any of your or other personal data that is not necessary. For the Company Community Channel, those data would become publicly available at your own risk. If a personal data of yours is shared by another user, you can contact us to ask for removal at privacy@hex-rays.com.
When you participate to online trainings: you are aware that it takes place on Google Meets. Recordings shall be sent to participants afterwards. You are also invited - at your choice - to discuss on Slack. You are responsible for the data you are willing to share with others through your account display and interactions (e.g. name, video, micro, chat).: please refrain from providing any of your or other personal data that is not necessary. - Age limit. Only entities and persons over the age of majority may use our products and services. However, younger persons may use them upon parental consent and responsibility.
Use of our and other webpages and platforms
- Other websites. The Notice is valid for all pages of the Website. It is not valid for the pages from third parties to which Hex-Rays may refer and whose privacy notices may differ (e.g. links redirecting to our reseller partners, our case studies resources…). Hex-Rays cannot therefore be held responsible for any data processed on these websites or by them.
- Social Media. This Notice also applies to any other webpages that Hex-Rays may operate, including social media (e.g. X, LinkedIn, YouTube, InfoSecExchange, BlueSky). Social Media platforms shall be considered as the sole Data Controller for the data processing activities linked to Hex-Rays page on the social media. The only exception is the statistical aggregated data generated (e.g. number of monthly visitors, from which countries to understand, analyze and potentially enhance services) and for which Hex-Rays is considered joint-controller with the social media, because it is the only processing over which Hex-Rays has a parameters control. This means that if you click on our social media page icon, you are redirected to the social media platform environment. Please refer to their Privacy Terms. Note that LinkedIn has created an "addendum" to their user agreements for company pages for the processing for which they are Joint-Controllers with us (meaning you can find there complementing information).
- Community Channels (e.g. Discourse, Slack) and Conferencing platform (e.g. Google Meets). This Notice also applies to our Community Channels and when you attend our online trainings. We are Controller of the data processed for our own purpose (e.g. providing you a space to receive information and interact) and within the parameters in our control and the Platform is Controller for the data they are collecting for their own, as detailed in their Privacy Notice:
You can also find on those platforms’ Privacy Policy helpful information on how to enhance your Privacy (display, settings…)
Why and for how long do we collect your personal data?
We are processing your personal data only for specific and specified purposes, according to lawful grounds. We are processing only the data necessary for each purpose. We will keep your data for no longer than necessary to fulfill our purposes. You will find a detailed description of the data processing in the table below.
Who is processing your data?
Sources. We are receiving personal data directly from you (through our interactions/your engagement e.g. the completion of webforms and account creation, from your use of our services and products including trackers e.g by navigating our website or using our licenses) or from a third party (Persons arranging for your access to our service e.g. your employer/academia, Partners e.g. if you buy a product directly through one of our resellers; Public Domain Source e.g. to verify you are not on a sanctions list,…)
No trade. We do not sell or trade your personal data to outside parties.
Recipients. Hex-Rays has contracted with the following recipients (vendors, Services Providers, Partners) that may have access to your personal data:
- Service providers: We may share your information with third party service providers who use this information to perform services for us, such as payment processors, hosting providers, auditors, advisors, consultants, customer service and support providers.
- Amazon for hosting.
- Refinitiv for enhanced due diligence.
- Stripe for payment processing.
- Discourse for community software.
- Slack and Google Meet for Training communication/ Organization.
- HubSpot for communication/statistics/analytics/benchmarking...
- Retool for license management.
- www.supabase.com for Customer portal authentication
- Partners: business partners to whom we provide content, who host events, third parties that help us deliver Services or act on our behalf such as our Resellers or training providers.
- Customers, users and their representatives: our customers who are purchasing or using our Services; our users, training participants, the person providing you access to our Services (e.g. your employer or Academia).
- Affiliates: The information collected about you may be accessed by or shared with subsidiaries and affiliates of Hex-Rays SA, whose use and disclosure of your personal information is subject to this privacy policy.
- Business transfers recipients: We may disclose or transfer information, including personal information, as part of any merger, sale, and transfer of our assets, or similar events
- Rights protection recipients: third parties where reasonably required to protect our rights, users, systems and services (e.g. legal counsel and information security professionals)
- Law Authorized recipients: third parties where we have a duty to or are permitted to disclose your personal information by law (e.g. government agencies, law enforcement, courts and other public authorities)
- At your request: Any person you have asked us to share information with (e.g. if you are asking to get in touch with our trainers for further support… )
Countries. Your data shall primarily be processed either in your own country or in Belgium (our establishment). Processing and sharing your personal data as explained above may involve a transfer of personal data in a third country. Should any data transfer occur, Hex-Rays is therefore committed to comply with the transfer rules under applicable Data Protection Laws and therefore ensure in relation to GDPR to:
- Transfer your data to territories that have been recognized as providing an adequate level of data protection by the European Commission or
- Where a country has not received an adequacy decision from the European Commission, to implement appropriate safeguards, such as the EU Standard Contractual Clauses ("SCCs").
You can contact our Data Protection Officer, hereinafter as DPO (privacy@hex-rays.com), if you want to have more details about the mechanism supporting data transfer.
How do we protect your information?
Hex-Rays treats your personal data in a confidential manner and provides for a sufficient and adequate level of protection of your personal data (including administrative, technical and physical safeguards) according to the risk level and the service provided and according to our policies and procedures aligned with the international standards.
We are continuously allocating resources to prevent security vulnerabilities in our products and services.
Your personal data are contained behind secured networks and are only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential.
For certain products and interactions, and as part of our screening and KYC (‘Know Your Customer”) procedure (e.g. to identify our customers/users as detailed in our Software License Sales Terms and Conditions/End User Agreement: to verify they are who they claim to be, are not on international sanctions lists and comply with export laws applicable to our sector), we may ask for a copy of your ID or other official identification document. In this case, we will redact the information we don’t need. We may also use data from databases from our enhanced due diligence provider (e.g. publicly available sources) and ask you further questions in the context of our screening – that may cover sensitive data such as political affiliation and/or opinion. Any information that will be collected and processed during our identification process complies to the strictest rules and procedures; are used only for compliance purposes and retained with upmost care.
What are your rights?
You have the following rights subject to limitation as set forth by applicable data protection law:
- Access. You have the right to obtain confirmation as to whether personal data concerning you are being processed, and, where that is the case, information related to the processing of data and a copy of the data being processed.
- Rectification. You have the right to require rectification of inaccurate or incomplete data about you.
- Right to be forgotten. You have the right to obtain the deletion of your personal data under certain specified circumstances.
- Restrict processing. You have the right to restrict processing of data under certain specified circumstances.
- Data portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your personal data.
- Object to processing. You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data.
- Right to withdraw consent. When you have given your explicit consent for the processing of your data, you can withdraw it at any time without any cost nor justification.
- Right not to be subject to a decision based solely on automated processing. When applicable, you have the right to a human intervention when decisions are taken based solely on automated processing, including for profiling, which produces legal effects concerning or similarly significantly affects you.
Please note that all these rights are not absolute and will be assessed on a case-by-case basis by our DPO.
If you would like to exercise your rights, please let us know by contacting us at privacy@hex-rays.com.
You also have the right to lodge a complaint if you consider that your personal data is not processed in accordance with the Data Protection Laws.
If you are in EU/EEA: You have the right to lodge a complaint with the Supervisory Authority in the Member State of the European Union/European Economic Area of your usual residence, place of work or place of the alleged infringement.
If you are in UK: you may file a complaint with the Information Commissioner’s Office ("ICO"), the Supervisory Authority of UK, following the instruction available in the service channels.
If you are located elsewhere: you may liaise with your local Data Protection/Supervisory Authority.
For all (no matter your location): in any case, anyone affected by our application of the GDPR may liaise with the Belgian Data Protection Authority (competent to monitor our compliance as a Belgian-based company) whose contact details are below.
Useful Contacts
Hex-Rays, acting as Controller
Rue Rennequin Sualem 34, 4000 Liège Belgium
privacy@hex-rays.com
+32-4-222-4300
Data Protection Officer
Supervisory Authority (Belgium)
Autorité de la protection des données - Gegevensbeschermingsautoriteit (APD-GBA)
Rue de la Presse 35 – Drukpersstraat 35
1000 Bruxelles - Brussel
Tel. +32 2 274 48 00
Fax +32 2 274 48 35
Email: contact@apd-gba.be
Website: https://www.autoriteprotectiondonnees.be or https://www.gegevensbeschermingsautoriteit.be
For other EU Data Supervisory Authorities
https://edpb.europa.eu/about-edpb/about-edpb/members_en
For UK Supervisory Authority (“ICO”)
Tel: +55 (0)3 03 12 31 11 3
Website: https://ico.org.uk/global/privacy-notice/your-right-to-complain/
Table: Description of the processing
Website visitors
|
Purposes of the processing |
Types of personal data |
Legal basis |
Retention period |
|
Requests. To answer to your queries, notably through our contact webform |
Mandatory: your query, your contact details to reply to you - In the context of the webform: your email address Optional: First and last name, any information you consider relevant in the context of your query |
This processing is based on our legitimate interest in answering the requests or queries raised by you through the existing different contact channels. We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised. |
We will process your data for the time necessary to meet your request unless we need to keep it for another purpose listed in this Privacy Notice. |
|
Marketing. To send you newsletters (news about our insights, updates and articles from the Hex-Rays team) |
Email address |
This processing is based on your consent. Please, remember that you may unsubscribe at any time without any cost. |
We will process your data until you unsubscribe or for a duration of 2 years. |
|
Statistics/Service improvement & development. To understand and analyze the way our pages are consulted; To gather metrics to better understand how users access and use our web site; to evaluate and improve our web site, and to develop new products and services. |
Aggregate statistical data (e.g., Company page on social media: Youtube, Linkedin, X….) |
We consider that we have a legitimate interest to understand the way our pages are consulted (e.g., how many times our page is consulted, from which country,…). |
Statistical information is stored by us in accordance with our Cookies Notice. They may be stored by third party when you are on their platform and subject to their Privacy Policy (e.g. for our social media pages/Community Channels/Communicating Platform) and consequently subject to their retention policy. We may export statistical reports from there.
|
|
Cookies specifics (e.g. Website functionality, enhanced user experience, statistics, advertising). Please, see our Cookies Notice for more information. |
Cookies may store in certain circumstances personal data which may include device information, usage information, browsing history, location and demographic information, identifiers: IP addresses, browser type, location, operating system,… |
Please, see our Cookies Notice for more information. |
|
|
Discourse user |
|||
To create/manage your Discourse account at your request (to allow you to interact and having a user-friendly experience, for us to identify you) Please refer to Discourse own Privacy Terms for their own purpose and legal basis of processing of your data |
Email, Username, password, Optional information for your account: First and last name |
This processing is based on your acceptance of the Discourse terms and our legitimate interest to provide a user-friendly forum; this is in your interest to have an account to ease your experience in the forum, For the Optional information: Your Consent by inserting the optional information |
We will keep your account for 3 years after you unsubscribe. Your logs will be kept for 1 year. Relevant data will be kept for 5 years after you unsubscribe for compliance reasons and longer only if necessary to comply with our Terms and/or with Law. For optional information, you may ask for their deletion at any time or delete them in your portal. Discourse shall keep data according to their terms |
|
To provide you the service and communicate with you; For technical assistance |
|
Your Acceptation of the Discourse Terms, and our legitimate interest in providing you a qualitative service |
|
|
To allow you to post and interact, there are “free text spaces” (implying information entry) |
“Your posts”, Content of your posts. Any personal data you may disclose in your posts. Please prevent to post any personal data about you or other persons. Those data would become publicly available at your own risk. If a personal data of yours is shared, you can contact us to ask for removal at: privacy@hex-rays.com |
This processing is based on your acceptance of the Discourse terms |
|
|
To enforce Terms of use and applicable Law (e.g. to prevent illegal content posts) Prevent misuse: Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our Terms of Service, License Agreement, or this privacy policy |
Your account information, interaction and activity, your IP address |
This processing may be based on (i) a legal obligation applicable to us (ii) your acceptance of the Discourse terms, (iii) our legitimate interest in providing (and for you to receiving) service with high standards of protection notably to prevent illegal activities ((iv) to a certain extent for public interest) |
|
|
To protect rights: manage and resolve possible litigation and disputes, proceedings, including defending our company’s interests; respond to claims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and protect the rights, property or safety of Hex-Rays, its users, or others. |
This processing is based on our legitimate interest in protecting any rights |
||
|
Statistics. To understand and analyze the way Discourse is consulted; To gather metrics to better understand how users access and use Discourse; to understand our sector/customers, improve/develop content, products/services. |
Anonymous/aggregated statistics such as data in relation to topics of interactions and engagement |
We have a legitimate interest to understand the way Discourse is used (e.g., which topic is consulted…). |
Statistical information is stored according to Discourse Privacy Policy; we may extract aggregated reports. |
|
Cookies. Use of cookies for the functioning and managing of our forum website |
Cookies may store personal data in certain circumstances which may include: IP addresses, browser type, location, operating system… |
Please, see our Cookies Notice for more information. |
Please see our Cookies Notice |
(prospective) Customers and end-users (including for free products)
|
Purposes of the processing |
Types of personal data |
Legal basis |
Retention period |
|||
Purchase/Acquisition of Products and Services. |
||||||
To create your Hex-Rays Account, to access your licenses, to upgrade or renew your licenses, to manage your subscriptions. We may proactively update you regarding information necessary to manage your account: software updates, license expiration, and renewals |
-If you are not a Customer: your email address -If you are a Customer, your email address, name, address, your subscriptions, your Software version. |
- This processing is based on our legitimate interest to direct/connect you to our Shop/customer portal and gives you the opportunity to request/receive a quote - Once a customer: this processing is based on our legitimate interest in providing a service for managing software licenses and subscriptions. We understand that the processing of these data is also beneficial to you as it allows you to quickly access and download IDA installers and license files, check the status of your licenses, manage your subscriptions. We need to manage your account data based on our contract. |
-If you are not a Customer and if you did not request a quote, we won’t store any of your data. If you request a quote your data will be retained for 12 months after the quotation. -If you are a Customer: we retain your logs for 1 year. We keep your account for 3 years after you are no longer a Customer and we shall keep the relevant data from your account for 3 years for Marketing purposes, for 5 years for compliance purposes and for up to 10 years for information necessary for accounting and tax reasons. |
|||
|
For quotes or any other question related to your interest in buying one of our products/services |
Information you provide linked to pricing/offers/questions we provide, including information specific to certain Products and Services (such as the number of seats/topics of interest for trainings…) |
This processing is based on your willingness for a (pre)contractual relationship. |
We will process your data until purchase; or if no purchase for 12 months after the quotation |
|||
|
For the purchase and payments |
Payment information: When you purchase our products or services, we may collect the information necessary to process your order. For online purchases you will be required to provide certain payment and billing information directly to our payment processing partners. |
This processing is based on our (pre)contractual relationship. |
We will keep your payment data for as long as necessary in relation to your order or to allow renewal as applicable depending on your subscription. |
|||
|
For accounting |
Information on Product(s)/Service(s) purchased by you and linked to your name |
This processing is based on a legal obligation applicable to us |
We will keep records of relevant information for accounting for 10 years |
|||
Provide our services |
||||||
|
To provide you the service and communicate with you; To provide customer support & technical assistance |
Contact details: Your email address and any applicable contact detail; Your request and queries if applicable. We will also request specific information necessary to provide certain Services (such as the number of seats/topics of interest for trainings) |
This processing is based on our contractual relationship. |
We will process the data for the time of the subscription; of solving customer service/assistance need; We will process your data for the time necessary to meet your request unless we need to keep it for another purpose listed in this Privacy Notice. |
|||
Marketing |
||||||
|
To send you commercial prospecting communications as a professional by e-mail, SMS and phone calls |
Name, email address, phone number… |
This processing is based on your consent, or on our legitimate interest if you have been informed that your contact details shall be used for solicitation and considering such solicitation is relevant to your field/profession. Please, remember that you may oppose at any time without any cost. |
3 years from collection of your personal data or once you unsubscribe |
|||
To send you communications, after having subscribed to one of our products(s)/service(s), for similar products or services, for marketing and special offers or promotions, or to otherwise contact you about products or information we think may be relevant to you. |
Email address, contact details, address, licensing details, products purchased, content of our communications… |
This processing is based on our legitimate interest to propose similar services that may be of your interest. Please, remember that you may unsubscribe at any time without any cost. |
We will process your data until 3 years after you are not a customer or unsubscribe to these communications. |
|||
|
To send you news and newsletters |
Email address, contact details, address, licensing details, products purchased, content of our communications… |
This processing is based on our legitimate interest to give you insights on our Company news that may interest you in relation to the Products and Services you use. Please, remember that you may unsubscribe at any time without any cost. |
We will process your data until 3 years after you are not a customer, or unsubscribe to the newsletters. |
|||
Compliance |
||||||
|
Eligibility, Pre-Screening and KYC: To identify you: to accept a potential customer/quote, we perform a screening and KYC for certain products to comply with guidance, rules and regulations that our Company applies, notably in terms of Export Laws and Sanctions as defined in our Software License sale Terms and Conditions (e.g. to verify our customers are who they claim to be, respect exports and sanctions rules in the software industry, prevent illegal activities via the use of our products and services) In certain instances, the KYC will be the responsibility of the reseller to whom you bought the Products. |
ID Copy or any other official identity document, data provided by you at our request, information contained in our enhanced due diligence service provider databases are collected from various sources, including, without limitation, from public sources (e.g. corporate websites), approved financial publications, from data subjects, from government records or databases (e.g. U.S. Securities and Exchange Commission, Companies House in the U.K.), and from third parties (e.g. business partners, colleagues of the data subject). For training: “KYC Guarantee” from the Education Provider for all the attendees (aggregated) - The attendee’s identity information, copy of an identity official document or other relevant screening information may be requested by the Education provider in order to perform the screening/KYC on behalf of the Company and for the Education provider to provide a guarantee to Company. |
This processing may be based, depending on the applicable rule, on (i) a legal obligation applicable to us (ii) your acceptance of our Company Software License Sale Terms and Conditions, (iii) our legitimate interest in providing service with high standards of protection and only to the destination of trusted customers to prevent misuse of our products and services and illegal activities ( (iv) to a certain extent for public interest) - and protect us against any regulatory and/or reputational risks that might arise in connection with entering into relationships and/or transactions with individuals and/or entities. |
When KYC applies to you as a Customer: We will retain your ID and prescreening information for as long as necessary to comply with our rules: for 5 years after you are no longer a customer. We will not use nor actively retain your ID copy or other identification documents after the verification is made. The data will only be hosted by our email platform for 5 years for compliance purposes. In case of complaint, dispute, litigation, (suspicion) of misuse and rule violation, we may receive additional information and/or process existing information for longer: those will be retained for no longer than necessary and in compliance with applicable Laws (notably depending on its nature) but generally for 5 years after the closure of the case. Such information can be provided to you at the time upon request. |
|||
|
Review and remove, any Customer Data which are deemed to be in violation with (i) the provisions of the Agreement or otherwise inappropriate, (ii) any rights of third parties, or (iii) any applicable legislation or regulation; Prevent misuse: Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our Terms of Service, License Agreement, or this privacy policy |
Any personal data, provided or submitted by the Customer (and/or any of its Affiliates) or on its behalf to Hex-Rays in the course of utilizing the Products and/or Services, (ii) any personal data that is collected or generated by the Products that result from queries made by the Customer, and (iii) any personal data, provided or submitted by Authorized Users when using the Products and/or Services (iv) Publicly shared information associated with the Customer’s use of the Products and/or Services, including comments or suggestions about the Products and/or Services |
This processing may be based, depending on the rule, on (i) a legal obligation applicable to us (ii) your acceptance of our Company Software License Sale Terms and Conditions and End User Agreement, (iii) our company legitimate interests |
||||
|
To comply with any guidance, policies, rules, laws and regulations that our Company applies; for any audits, proof, invoicing/finance records, necessity to demonstrate our duties and obligations are accomplished |
||||||
|
To perform any obligations under the Agreement |
This processing is based on our contractual relationship. |
|||||
|
To protect rights: manage and resolve possible litigation and disputes, proceedings, including defending our company’s interests; respond to claims asserted against us or, comply with legal processes (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and protect the rights, property or safety of Hex-Rays, its users, or others. |
||||||
|
Negotiation and execution of contract |
||||||
|
To negotiate, execute a contract, To Perform any obligations under the Agreement; To manage communications and our contractual relationship during the performance of the contract. |
Some of your personal data may be processed, such as name, email address, phone number, role in the company, signature of the representative, phone number… |
This processing is based on the legal basis of the “contract” and/or our common legitimate interest to communicate in the context of a business relationship. |
5 years after the end of our relationship. |
|||
|
Financial Management |
||||||
|
To manage financial aspects during the performance of our contracts. This includes managing payments, invoicing, send reminders, renegotiate contract terms… |
Name, email address, phone number, role in the company, phone number … |
This processing is based on our legitimate interest. |
10 years after the end of our relationship. |
|||
|
Product specifics: Training |
|||
|
To organize your participation/ For Training Performance |
|||
|
To allow the organization of our training sessions and for Participants to discuss and interact, you are invited to participate in a chat on a Provider platform of discussion (“Slack”). You can find here Slack Privacy Terms: https://slack.com/intl/en-gb/trust/privacy/privacy-policy |
Account management, assistance, compliance: Email address, WorkSpace features, your messages, files or other content. Statistics: content of interactions in an aggregated manner |
(Your consent by entering Slack environment at your choice); |
Slack shall retain data for their purpose according to their Privacy Policy. Relevant data are used directly for training organization. Relevant data if necessary are kept for 5 years for compliance and aggregate data for 5 years for statistical reasons. |
|
To allow you to follow the Training, you are participating to an online Videoconference on Google Meet where you shall identify yourselves. Consequently, you are informed that your pseudonym will appear and any interaction (voice, video, chat) will be shared with other Participants of the same training course. Please refrain to share information you are not willing to share. |
To enter Google Meet: nickname Your interactions at your will (video, voice, chat) To provide after the training: recordings |
You are not obliged to have a Google account. The entering in Google Meet as well as the recordings are based on your acceptance of our Terms (necessary for you to follow the Training). Your real name, video, chat, voice only if you consent |
Data are retained by Google according to their Privacy Policy. Recordings are retained by us for 5 years |
End- Users |
|||
To identify authorized users; and for users to use the products/services |
Credentials: email, license key, MAC address |
The processing is necessary for the execution of the End User License Agreement |
We will keep your logs (when applicable) for 1 year and your account information for 3 years after the end of the contract. Relevant account data are kept during 3 years for Marketing purposes and 5 years for compliance purposes. In case a KYC is performed with your information: We will not use nor actively retain your ID copy or other identification documents after the verification is made. The data will only be hosted by our email platform for 5 years. In case of a complaint, dispute, litigation, (suspicion) of misuse and rule violation we may receive additional information and/or process existing information for longer: those will be retained for no longer than necessary and in compliance with applicable Law (notably depending on its nature) but generally for 5 years after the closure of the case. Such information can be provided to you at the time upon request. |
|
For verifying adherence to the terms and conditions set forth in the End User License Agreement |
“End User data” as defined in the End User License Agreement: the feedback, data or other information provided by You via the use of the Software, including by uploading or creating data or content through the Software or information in connection with your use or performance of the Software |
The processing is necessary for the execution of the End User License Agreement |
|
|
For user analytics, improvement of the performance of the Software or for developing updates to the Software (disclosure only in an aggregate manner) |
The processing is necessary for the execution of the End User License Agreement, our legitimate interest in improving /developing our products and services |
||
|
To provide and maintain the Software; including preventing security vulnerabilities |
The processing is necessary for the execution of the End User License Agreement |
||
|
To review and remove any End User Data which is deemed to be in violation with the provisions of the End User License Agreement or otherwise inappropriate, any rights of third parties or any applicable legislation or regulation (such as Export law relative to sanctions and as defined in the End User License Agreement). |
This processing may be based, depending on the rule, on (i) a legal obligation applicable to us (ii) your acceptance of the End User Agreement, (iii) our legitimate interest in providing service with high standards of protection and only to the destination of trusted users. |
||
Analytics/Business Purposes |
|||
|
For industry analysis, benchmarking, analytics, marketing, and other business purposes. All data collected, used, and disclosed will be in aggregate and in an anonymized form only and will not permit to identify Customer, its Authorized Users or Customer Data. |
Quantitative data derived from the use of the Products |
Data are collected and aggregated based on our legitimate interest |
We will process aggregated data for the time necessary for our analysis and up to 5 years after you ceased to be a user |
Marketing |
|||
To send you communications, after having subscribed to one of our products(s)/service(s), for similar products or services, for marketing, special offers and promotions, or to otherwise contact you about products or information we think may be relevant to you. |
Email address, contact details, address, licensing details, products purchased, content of our communications… |
This processing is based on our legitimate interest to propose similar products and services that may be of your interest. Please, remember that you may unsubscribe at any time without any cost. |
We will process your data until 3 years after you have ceased to be a user, or unsubscribe to the marketing list. |
|
To send you news and newsletters |
Email address, contact details, address, licensing details, products purchased, content of our communications… |
This processing is based on our legitimate interest to give you insights on our Company news that may interest you in relation to the Products and Services you use. Please, remember that you may unsubscribe at any time without any cost. |
We will process your data until 3 years after you ceased to be a user, or unsubscribe to the marketing list. |
|
Plug-in Repository and Contest |
|||
|
Plug-in Repository |
|||
To identify a Plug-In creator: (i) to identify/link you as one of our product users, (ii) to know the author of the submission. |
First name, last name, email, password |
This processing is based on our legitimate interest to identify and keep records of the authors of the plug-ins submitted. |
We will process your data for 5 years after your plug-in has ceased to be available to users or upon request from a plug-in creator. |
|
For compliance: (i) To comply with any guidance, policies, rules, laws and regulations that our Company applies ; (ii)To comply with any Agreement in place with you, (iii) To Prevent misuse: Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our Terms of Service, License Agreement, or this privacy policy |
First name, last name linked to the plug-in submitted, email address |
This processing is based on our legitimate interest to keep records of the authors of the plug-ins submitted for compliance reasons. |
|
|
For the plug-in submission |
Your plug-ins, explanatory note, author name |
This processing is based on our legitimate interest to manage the plug-ins submitted |
|
|
For your author’s name publication (together with your submitted plug-in publication) on our website |
Name |
This processing is based on our legitimate interest to manage the plug-ins submitted (you are not obliged to provide a real name and you can rather suggest a pseudonym) |
We will process your data for 5 years after your plug-in has ceased to be available to users or upon request from a plug-in creator. |
|
Contest Participants |
|||
To identify you |
Author name: who should be credited for the plugin - The name(s) of the individual(s), or the company name, or the university name.
|
The processing of the participants is based on the necessity to comply with the rules, terms and conditions of the Contest that may include compliance with our License Sales Terms and Conditions and End User License Agreement The processing of the participants is also based on our legitimate interest for the purpose of our contest process to administer and appraise submissions, comply with the contest rules (e.g. confirm eligibility), communicate with you. We understand that the processing of these data is also beneficial to you as it allows you to participate to the contest, submit your plug-in to the community and potentially win the contest. |
We will process your data for 5 years after your plug-in has ceased to be available to users or upon request from a plug-in creator. |
|
To confirm your eligibility to the contest |
license holder details, declaration that you are not on a sanction list… |
||
|
To evaluate and assess the quality of the submission |
Source code and a small description on how to use the plug-in |
||
|
To communicate with you |
contact detail (email address) |
||
|
Contest winners |
|||
For your author’s name publication (together with your submitted plug-in publication) on our website |
The name(s) of the individual(s), or the company name, or the university name |
This processing is based on our legitimate interest to manage the plug-in contest and communicate about the winners (you are not obliged to provide your name and you may rather use a pseudonym) |
You may withdraw your consent for the use of your name at any time. |
|
Pre-Screening and KYC: To identify you: to accept a potential winner, we perform a screening and KYC for certain products to comply with guidance, rules and regulations that our Company applies, notably in terms of export Laws and Sanctions as defined in our Software License sale Terms and Conditions (e.g. to verify our customers are who they claim to be, respect export and sanctions rules in the software industry, prevent illegal activities via the use of our products and services) |
a valid form of identification (driver's license, ID card, or passport) |
This processing may be based, depending on the applicable rule, on (i) a legal obligation applicable to us (ii) your acceptance of our Company Terms and Conditions, (iii) our legitimate interest in providing service with high standards of protection and only from trusted contestants to prevent misuse of our products and services and illegal activities ( (iv) to a certain extent for public interest) - and protect us against any regulatory and/or reputational risks that might arise in connection with entering into relationships with individuals and/or entities and providing their plug-in on our Website |
We will retain your ID and prescreening information for 5 years after your plug-in has ceased to be available to users or upon request from a plug-in creator. |
|
To give you the Prize |
bank account information |
To comply with the Terms and Conditions of the Contest |
We will process your data for the time necessary to execute the payment. |
Job Applicants
|
Careers. (to collecting, sorting, reviewing, ranking and reviewing information on application forms or CVs ; assess a candidate's suitability for a given job, or to measure his or her professional skills (qualifications, experience, etc.) ; pre-selection of candidates; collecting new information at interview; collecting information at assessments; and verifying candidates eligibility). |
For our open positions, we collect: At a later stage, information may be collected through our communications, interviews, your profile review and assessment, background checks with publicly available information, previous employers… |
This processing is based on the legal basis of the “contract” for pre-contractual measures taken at the applicant's request, for the receipt and classification of applications sent by the applicant. This processing is also based on our legitimate interest for the purpose of our recruitment process to administer and appraise job applications. We understand that the processing of these data is also beneficial to you to the extent that it allows the candidate to provide providing a spontaneous application or to answer to an offer. Optional information is based on your consent. |
We will process your data for the time necessary to manage your application and fill the open position. |
|
In case of spontaneous applications (as described for any candidate above. In addition to recontact you to propose you positions) |
Information you provide that are relevant for an application. |
We will retain your data for two years |
|
|
At the end of a recruitment process for a specific position on our website, to keep the applicants in a “candidate pool” database. |
See above (“to administer and appraise job applications) |
Consent |
We will retain your data for two years |
(potential) Partners, Service Providers, Vendors
|
Purposes |
Types of personal data |
Legal basis |
Retention period |
|
Negotiation and execution of contract |
|||
|
To negotiate a potential contract with Partners, Service Providers… (See notably “Becoming a Partner” tab) |
Some of your personal data may be processed, such as name, email address, phone number, role in the company, signature of the representative… |
This processing is based on the legal basis of the “contract” for pre-contractual measures and on our common legitimate interest on becoming Partners. |
5 years after last interaction |
|
To execute a contract, To Perform any obligations under the Agreement; To manage communications and our contractual relationship with our Clients, Suppliers, Co-contractors and Partners during the performance of the contract. This can include sending you emails, managing work orders, organizing meetings, updating our Clients, Suppliers, Co-contractors and Partners’ information, sharing your data within the framework of our own contracts,… For trainers, it will include the presentation, recording of training and its publication to Participants. |
Some of your personal data may be processed, such as name, email address, phone number, role in the company, signature of the representative, phone number… Name, Video and audio recording |
This processing is based on the legal basis of the “contract” and/or our common legitimate interest to communicate in the context of a business relation. |
5 years after the end of our relationship. |
|
Financial Management |
|||
|
To manage financial aspects with our Clients, Suppliers, Co-contractors and Partners during the performance of our contracts. This includes managing payments, invoicing, sending reminders, renegotiating contract terms… |
Name, email address, phone number, role in the company, phone number … |
This processing is based on our legitimate interest. |
10 years after the end of our relationship. |
|
Compliance and possible litigation |
|||
|
To protect rights: manage and resolve possible litigation and disputes, proceedings, including defending our company’s interests; respond to claims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and protect the rights, property or safety of Hex-Rays, its users, or others. |
Name, email address, phone number, role in the company, phone number … |
This processing is based on our legitimate interest. |
for tax information.
|
|
To comply with any guidance, policies, rules, laws and regulations that our Company applies; for any audits, proof, invoicing/finance records, necessity to demonstrate our duties and obligations are accomplished |
Name, email address, phone number, role in the company, phone number, incorporation documents, information allowing to identify company’s owners |
This processing is based on our business compliance legitimate interest, it may also be covered by our contract and/or a legal obligation. |
|
|
Review any collaboration which are deemed to be in violation with (i) the provisions of the Agreement or otherwise inappropriate, (ii) any rights of third parties, or (iii) any applicable legislation or regulation; Prevent misuse: Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our Terms of Service, Reseller Agreement or other applicable agreement, or this privacy policy; Perform any obligations under the Agreement |
Any personal data, provided or submitted by you (and/or any of your Affiliates) or on your behalf to Hex-Rays, Information publicly available, Information provided by a Third Party |
This processing may be based, depending on the rule, on (i) a legal obligation applicable to us (ii) your acceptance of our Agreement, (iii) our company legitimate interest to prevent illegal activities, our products and services misuse, protect us against any regulatory and/or reputational risks |
|
Partners Screening and KYC Check |
|||
|
Partner Pre-Screening and KYC: To identify you: to accept a potential partner/reseller, we perform a screening and KYC to comply with guidance, rules and regulations that our Company applies, notably in terms of export Laws and Sanctions as defined in the Agreement (e.g. to verify our resellers are who they claim to be, respect export rules in the software industry, prevent illegal activities via the (re)selling of our products and services) |
ID Copy or another official identification document, data provided by you at our request (notably in forms attached to our Reseller agreement), information contained in our enhanced due diligence service provider databases are collected from various sources, including, without limitation, from public sources (e.g. corporate websites), approved financial publications, from data subjects, from government records or databases (e.g. U.S. Securities and Exchange Commission, Companies House in the U.K.), and from third parties (e.g. business partners, colleagues of the data subject). |
This processing may be based, depending on the applicable rule, on (i) a legal obligation applicable to us (ii) your acceptance of our Company Software License Sale Terms and Conditions, Reseller Agreement or any other Agreement (iii) our legitimate interest in collaborating with trusted Partners to prevent misuse of our products and services and illegal activities ( (iv) to a certain extent for public interest) - and protect us against any regulatory and/or reputational risks that might arise in connection with entering into relationships and/or transactions with individuals and/or entities. |
We will not use nor actively retain your ID copy or other identification documents after the verification is made. The data will only be hosted by our email platform for 5 years. |
|
Marketing purposes for professionals |
|||
|
To send you commercial prospecting communications as a professional by e-mail, SMS and phone calls. |
Name, email address, phone number… |
This processing is based on your consent, or on our legitimate interest if you have been informed that your contact detail shall be used for solicitation and considering such solicitation is relevant to you. Please, remember that you may oppose at any time without any cost. |
3 years from collection or once you unsuscribe |
|
To send you commercial solicitation as a professional (for existing Clients, Co-contractors, Suppliers and Partners), for instance, to suggest new services or to personalize our communications to meet the specific needs of our Clients, Co-contractors, Suppliers and Partners |
Name, email address, phone number, communication histories… |
This processing is based on our legitimate interest. Please, remember that you may unsubscribe at any time without any cost. |
3 years after the end of the partnership or once you unsubscribe |
|
To receive our Customer Company newsletters To receive our Company marketing communications, special offers and promotions, or to otherwise contact you about products or information we think may be relevant to you. |
Email address, contact details, address, licensing details, products purchased, content of our communications… |
This processing is based on your consent when you are a Prospect; once in a Partnership: on our legitimate interest to give you insights on our Company news that may be relevant to you in relation to our partnership; or promotions and special offers. Please, remember that you may unsubscribe at any time without any cost. |
3 years after the end of the partnership or once you unsubscribe |
|
Product and Service Development |
|||
|
To develop and enhance products or services, based on feedback and market analysis. |
Names, job titles, email addresses of the individuals providing feedback. |
This processing is based on our legitimate interest. |
For the time necessary to achieve the analysis purpose unless you opt out (and for up to 5 years) |
Still have questions?
Do you need advice in selecting the right plan or managing your account?
Products
Case studies
Resources
Connect with the community on
© 2025 Copyright Hex-Rays