Privacy Notice

1. Introduction

This privacy notice (“Notice”) describes how Coveo Solutions, Inc. and its relevant affiliates (“Coveo” or “we” or “us”) collect, use, disclose, transfer, store and otherwise process personal information relating to you (“Personal Information”) in the course of its activities described below.

Coveo as a Service Provider

Coveo provides cloud-based services to its customers pursuant to a written agreement (“Cloud Service”). Our customers and their authorized users upload and store personal information on the Cloud Service (“Customer Personal Information”). Coveo processes Customer Personal Information in its cloud-based solutions on behalf of its customers and only in accordance with their written instructions. Coveo is acting as a “processor” or as a “service provider” with regard to Customer Personal Information. Therefore, this Notice does not apply to Customer Personal Information.

For detailed information related to a Coveo customer using Coveo Cloud Service as a “controller”, you should contact the Coveo customer directly or refer to their privacy notice. In particular, if your Personal Information has been submitted to us on behalf of a Coveo customer and you wish to exercise your rights under applicable privacy laws, please direct your requests to the Coveo customer. If you contact Coveo for these purposes, we are required to inform the relevant Coveo customer of your request (to the extent that we can identify them from the information you have provided).

Supplemental Privacy Notices

We supplement this Notice with the following specific notices:

• Cookie Notice This notice applies in connection with our use of cookies and other tracking technologies.
• Applicant and Candidate Privacy Notice This notice applies when we collect and use Personal Information in connection with our recruitment process.

Table of Contents

We recommend that you read this Notice in full to ensure that you are fully informed about the manner in which we collect and use or otherwise process your Personal Information. You can also refer to a specific section of this Notice by clicking on the relevant link below:

• 2. Personal Information We Collect
• 3. How We Use Your Personal Information
• 4. Cookies and Other Technologies
• 5. With Whom We Disclose Your Personal Information
• 6. How We Protect Your Personal Information
• 7. Retention of Personal Information
• 8. Your Privacy Rights
• 9. International Transfers
• 10. Contacting us
• 11. Modifications to the Notice
• 12. US Privacy Notice

2. Personal Information We Collect

The table below describes the categories of Personal Information that we collect and the situations in which we collect it.

3. How We Use Your Personal Information

We generally process your Personal Information for our business purposes that help us fulfill a request or a contractual obligation, promote our services or otherwise conduct our business. Those reasons are called “legitimate interests” in the European Economic Area (“EEA”) and in the United Kingdom (“UK”).

Artificial intelligence (“AI”) capabilities. Our processing of Personal Information for the purposes and legal basis described in the table above also include the use of automated methods of processing, including profiling (including artificial intelligence and generative intelligence capabilities), which may be used to analyze your Personal Information, determine trends or create AI-generated answers or other content. For example, we may use AI capabilities to streamline processes and improve efficiency, such as generating summary transcripts of conversations. These tools are only used to assist our teams, and all decisions are thoroughly reviewed under human oversight to ensure accuracy and fairness.

4. Cookies and Other Technologies

Coveo’s websites may use “cookies” and other technologies. For more information about those technologies, please visit our Cookie Notice

5. With Whom We Disclose Your Personal Information

We only disclose and share your Personal Information as follows:

With affiliates. Coveo is headquartered in Canada and has affiliates located all over the world, which includes Canada, the United States (“US”), the EEA and the UK In order to conduct our business activities described in Section 2, Coveo may share your Personal Information with its affiliates. In such instances, Coveo ensures an adequate level of protection for Personal Information.

With service providers. Coveo discloses your Personal Information with service providers with whom it has contracted in order to provide services on behalf of Coveo. These providers will access and process your Personal Information only as instructed by Coveo. This may include customer relationship management, marketing purposes, billing purposes, data analysis, information security, technical support, customer services or any other business purpose described in this Notice.

With business partners. From time to time, Coveo may partner with other companies to support its business. This may include resellers, referral partners,social networks or event sponsors. In such instances, your Personal Information will be processed separately by those partners and will be subject to the respective partner’s or sponsor’s privacy Notice. For instance, if you purchase or specifically express interest in a jointly-offered product, promotion or service from Coveo, if you attend an event or webinar, Coveo may share Personal Information about you collected in connection with your purchase or expression of interest with our joint partner(s). Coveo does not control its business partners’ use of your Personal Information, and their use of the information will be in accordance with their own privacy policies. If you do not wish for your information to be shared in this manner, you may choose not to purchase or specifically express interest in a jointly offered product or services.

With Advertising and analytics partners. We may share your information collected through the use of cookies and other tracking technologies with advertising and analytics networks or technology providers as set forth in our Cookie Notice.

With Professional advisers. In some instances, we may share your Personal Information with professional advisers including lawyers, bankers, auditors or accountants.

Where required by laws. Coveo may share your Personal Information where it believes in good faith that it is necessary to respond to lawful requests, to protect its rights and property, to protect the interests of its customers or to enforce the terms of its terms of use.

Where necessary for business transaction purposes. If Coveo goes through a merger, an acquisition, a sale of all or a portion of its assets, your Personal Information may be included in the assets involved in the transfer.

6. How We Protect Your Personal Information

Coveo takes technical, physical and organisational measures to safeguard your Personal Information. These safeguards are designed to prevent the loss, theft, unauthorized access, use, disclosure, alteration or destruction of your Personal Information and are commensurate to the sensitivity of the information.

For instance, Coveo ensures that its personnel processing Personal Information is bound by appropriate obligations of privacy and confidentiality and access to Personal Information by Coveo personnel is performed on a need-to-know basis.

7. Retention of Personal Information

Coveo will retain your Personal Information for the period necessary to fulfil the purpose for which it was intended, as outlined in this Notice unless a longer period is required by law.

8. Your Privacy Rights

You may have certain rights relating to your Personal Information, subject to domestic data privacy laws. This may include:

• the right to access and receive a copy of your Personal Information, or specific pieces of Personal Information, in a readable format;
• the right to know the categories of sources from which your Personal Information was collected;
• the right to know the categories of third-parties with whom your Personal Information was shared;
• the right to rectify inaccurate or outdated Personal Information we hold about you and to ensure that it is complete;
• the right to erase your Personal Information, under specific circumstances;
• the right to restrict the processing of your Personal Information;
• the right to ask us to transfer your Personal Information to another controller, when technically feasible, in a format commonly used;
• the right to object to the processing of your Personal Information, when the processing of your Personal Information is based on our legitimate interests or when used for direct marketing purposes. In particular, if you do not want to be on our mailing list, you can opt out anytime here;
• the right to opt-out of certain disclosures of your Personal Information to third-parties;
• the right not to be subject to a decision based solely an automated decision-making, including profiling, which produces legal effects or otherwise significantly affects you (“Automated Decision Making”) ; and
• the right to lodge a complaint before a regulator or a supervisory authority about our processing of your Personal Information.

In order to exercise your rights with regard to your Personal Information in our possession, please contact privacy@coveo.com. Coveo will treat your request in accordance with applicable domestic laws.

Coveo will not discriminate against you for exercising your rights described above or offer you financial incentives related to the use of your Personal Information.

9. International Transfers

Coveo has facilities and employees in different countries around the world. This includes Canada, the EEA, the UK and the US. We may also partner with third parties located or that host your Personal Information on our behalf outside of your state or province in order to conduct our business. For instance, most of our service providers host your Personal Information in the US. Therefore, your Personal Information may be transferred and/or accessed outside your country or province of residence. When we send your Personal Information across borders, we will process it only for the purposes outlined in this Notice and we will take steps to ensure that your Personal Information is adequately protected abroad.

Coveo relies on appropriate transfer mechanisms when transferring your Personal Information from the EEA, the UK or Switzerland to a third country. Please visit this page for more information.

Coveo also abides by the EU-US, Swiss-US Data Privacy Framework and the UK extension to the EU-US Data Privacy Framework . Please visit this page for more information.

10. Contacting us

If you have any questions about this Notice or Coveo’s privacy practices, please contact our Data Protection Officer (“DPO”) or our EU representative by clicking here or by mailing Coveo Privacy at:

• Coveo, Software Corp., Spaces Levi's Plaza, 1160 Battery Street East, Suites 100, San Francisco, CA, 94111, United States, if you reside in the United States of America, Mexico or a country in Central or South America or the Caribbean;
• Coveo Solutions, Inc. 3175 Chemin des Quatre-Bourgeois, Suite 200, Quebec City, QC, G1W 2K7, Canada, if you reside in Canada, a Country in Asia or the Pacific region;
• Coveo (Europe) B.V., Beech Avenue, 54-80 1119 PW, Schiphol-Rijk, the Netherlands, if you reside in a country in Europe, the Middle East or Africa.

11. Modifications to the Notice

Coveo may update this Notice from time to time in order to reflect changing practices or requirements of applicable privacy laws. The legend at the top indicates when this Notice was last revised. We encourage you to regularly review this Notice to stay informed of Coveo’s processing of your Personal Information.

12. US Privacy Notice

Some U.S. States laws, including the California Consumer Privacy Act (“CCPA”), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring and the Utah Consumer Privacy Act require additional disclosure for their residents. This section solely applies to individuals residing in certain U.S. States.

Coveo collects Personal Information from different sources, as set forth in Section 2.

Coveo shares Personal Information with service providers or business partners with whom we have signed an agreement regarding the use of your Personal Information.

The table below describes what categories of Personal Information we collect about you and to whom we disclose such Personal Information. For reference, Sections 2 and 5 also provide such information.

Coveo does not sell or share Personal Information for monetary consideration. We engage in routine business practices with business partners that may be considered a “sell” or “sharing” to third parties as defined under the CCPA and as described in the table below:

Coveo uses Personal Information for the purposes described in Section 3.

For information regarding the exercise of your rights, you can refer to Section 8 of this Notice. You may use an authorized agent to submit a consumer request on your behalf in which case Coveo will require a copy of your written authorization to submit the request on your behalf.

As a U.S. resident, you also have a right to opt-out of the sale or sharing of your Personal Information. You may opt-out of the sharing of Personal Information by:

• selecting the option to opt-out of the use of cookies in the cookie settings banner;
• turning on a Global Privacy Control in your web browser or browser extension. For more information on valid Global Privacy Controls, please refer to this website: https://oag.ca.gov/privacy/ccpa.
• clicking on the “unsubscribe” link at the bottom of a Coveo commercial message;
• opt-out of the use of your email address here.
• sending an opt-out request to privacy@coveo.com.