Google Cloud Privacy Notice

Google processes Customer Data, Partner Data and Service Data to provide Cloud Services. This Privacy Notice applies solely to Service Data and does not apply to Customer Data or Partner Data. We explain what we mean by Service Data below.

Customer Data and Partner Data are defined in the agreement(s) with our customers covering Cloud Services and represent the data that you and our customers provide for processing in Cloud Services. For more information about how we process Customer Data and Partner Data, see our Cloud Data Processing Addendum (Customers) and Cloud Data Processing Addendum (Partners).

Service Data is the personal information Google collects or generates during the provision and administration of the Cloud Services and related technical support, excluding any Customer Data and Partner Data.

Service Data consists of:

• Account information. We collect the data you or your organization provide when creating an account for Cloud Services or entering into a contract with us (username, names, contact details and job titles).
• Cloud payments and transactions. We keep reasonable business records of charges, payments, and billing details and issues.
• Cloud settings and configurations. We record your configuration and settings, including resource identifiers and attributes, and service and security settings for data and other resources.
• Technical and operational details of your usage of Cloud Services. We collect information about usage, operational status, software errors and crash reports, authentication details, quality and performance metrics, and other technical details necessary for us to operate and maintain Cloud Services and related software. This information includes device identifiers, identifiers from cookies or tokens, and IP addresses.
• Your direct communications. We keep records of your communications and interactions with us and our partners (for example, when you provide feedback, ask questions or seek technical support).

Google processes Service Data for the following purposes:

• Provide Cloud Services you request. We use Service Data primarily to deliver the Cloud Services that you and our customers request. This includes processing Service Data as needed to conduct checks before extending credit to certain customers, to bill for the Cloud Services used, to ensure those services are delivered or working as intended, to detect and avoid outages or other technical problems, and to secure your data and services.
• Make recommendations to optimize use of Cloud Services. We use Service Data to provide you and our customers with recommendations (for example, suggesting ways to better secure your account or data, reduce service charges or improve performance, or optimize your configurations), and providing information about new or related products and features. We also evaluate your responses to our recommendations and other feedback (if you choose to provide it).
• Maintain and improve Cloud Services. We evaluate Service Data to help us improve the performance and functionality of Cloud Services. As we improve Cloud Services for you, this will improve them for our customers, and vice versa.
• Provide and improve other services you request. We use Service Data to deliver and improve other services that you and our customers request, including Google or third-party services that are enabled via the Cloud Services, administrative consoles, application programming interfaces (APIs) or command line interfaces (CLIs), or the Google Workspace Marketplace.
• Assist you. We use Service Data to provide technical support for Cloud Services that you and our customers request, and to assess whether we have met your needs. We also use Service Data to improve our technical support, inform you and our customers about updates to Cloud Services and send other notifications relating to Cloud Services.
• Protect you, our users, customers, the public, and Google. We use Service Data to detect, prevent and respond to fraud, abuse, security risks, and technical issues that could harm you, other users, our customers, the public, or Google. This helps make our services safer, more reliable, and more secure.
• Comply with legal obligations. We use Service Data to comply with our legal obligations (for example, where were responding to legal process or an enforceable governmental request, or meeting our financial record-keeping obligations).

To achieve these processing purposes, we use algorithms to recognize patterns in Service Data, manual review of Service Data (such as when you interact directly with our billing or support teams), aggregation or anonymization of Service Data to eliminate personal information, and combination of Service Data with information from other Google products and services. We also use Service Data for internal reporting and analysis of applicable product and business operations.

Please note, if your organization has entered into a Service Data Addendum for any Cloud Services:

• your organization will process Service Data collected or generated from those Cloud Services, as a controller, for purposes it is required to disclose to you separately; and
• Googles processing purposes listed above will not apply to you. The purposes that apply to you are described in the Supplemental Google Cloud Privacy Notice. Please visit that link to learn more.

We maintain data centers around the world, and provide Google Workspace (including Google Workspace for Education) and Cloud Identity (when sold separately) from these locations, and Google Cloud Platform from these locations.

Service Data may be processed on servers located outside of the country where our users and customers are located because Service Data is typically processed by centralized or regionalized operations like billing, support, and security.

Regardless of where Service Data is processed, we apply the same protections described in this Privacy Notice. When transferring Service Data outside of the European Economic Area, the UK or Switzerland, we comply with certain legal frameworks.

We build Cloud Services with strong security features to protect your data. The insights we gain from providing our services help us detect and automatically block security threats from ever reaching you.

We work hard to protect the Service Data we hold from unauthorized access, alteration, disclosure, or destruction, including by:

• Encrypting Service Data at rest and while in transit between our facilities.
• Regularly reviewing our Service Data collection, storage, and processing practices, including our physical security measures, to prevent unauthorized access to our systems; and
• Restricting access to Service Data to Google employees, contractors, and agents who need it in order to process Service Data for us. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.

We instruct our affiliates to process Service Data for the purposes listed under "Why We Process Service Data" above, in compliance with this Privacy Notice and appropriate confidentiality and security measures. 

We do not share Service Data with companies, organizations, or individuals outside of Google except in the following cases:

• When you procure third-party services

We share Service Data outside of Google when you or our customer choose(s) to procure a third-party service through Google Cloud Platform, the Google Cloud Platform Marketplace or the Google Workspace Marketplace, or use a third-party application that requests access to your Service Data.

• With your consent

Well share Service Data outside of Google where we have obtained your consent.

• With your administrators and authorized resellers

When you use Cloud Services, your administrator and resellers authorized to manage your or your organizations account will have access to certain Service Data. For example, they may be able to:

• View account and billing information, activity and statistics
• Change your account password
• Suspend or terminate your account access
• Access your account information in order to satisfy applicable law, regulation, legal process, or enforceable governmental request
• Restrict your ability to delete or edit your information or your privacy settings
• For external processing

We do not sell your Service Data to any third parties.

We share Service Data with trusted third party providers to process it for us as we instruct them and in compliance with this Privacy Notice and appropriate confidentiality and security measures. In particular, we share Service Data with our third party providers when you request technical support services (we share the information you provide in the support ticket, and those providers may communicate with you or your administrator in that ticket, including providing updates and closing the ticket) and professional services (we share your contact details to enable communication and collaboration).

• For legal reasons

We share Service Data outside of Google when we have a good-faith belief that access to, or disclosure that Service Data is reasonably necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request. We share information about the number and type of requests we receive from governments in our Transparency Report.
• Enforce applicable agreements, including investigation of potential violations.
• Detect, prevent, or otherwise address fraud, security, or technical issues.
• Protect against harm to the rights, property or safety of Google, our customers, users, and the public as required or permitted by law.

If Google is involved in a reorganization, merger, acquisition, or sale of assets, well continue to ensure the confidentiality of Service Data and give affected users notice before Service Data becomes subject to a different privacy policy.

Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google. Some Google Cloud Services enable you to directly access and download the data you have stored in the services. As further described in our Google Workspace Data Subject Requests Guide, you or your organization may use various tools to access, control, and export your data.

You and your organizations administrator can access several types of Service Data directly from Google Cloud, including your account information, billing contact information, payment and transaction information, as well as product and communication settings and configurations.

If youre otherwise unable to access your Service Data, you can always request it here.

We retain Service Data for different periods of time depending on the type of data, how we use it, and how you configure your settings. When we no longer need Service Data, we delete or anonymize it.

For each type of Service Data and processing operation, we set retention timeframes based on the purposes for which we process it, and ensure that the Service Data is kept for no longer than necessary. We retain most types of Service Data for a set period of up to 180 days (the exact number depends on the specific type of data). However, some Service Data may be kept for longer periods where there is a business need. We generally have longer retention periods (which can be over a year) for Service Data that is kept for the following purposes:

• Security, fraud and abuse prevention. We retain Service Data when it is necessary to protect against fraudulent attempts to gain access to user accounts, or to investigate violations of applicable Cloud Services agreements. Usually, the Service Data retained where there is reason to suspect fraud or abuse would include device identifiers, identifiers from cookies or tokens, and IP addresses, as well as log data about usage of the Cloud Services. 
• Complying with legal or regulatory requirements. We retain Service Data when required by an enforceable legal process, such as when Google receives a lawful subpoena. 
• Complying with tax, accounting or financial requirements. When Google processes a payment for you, or when you make a payment to Google, we retain Service Data about those transactions (including billing information), typically for a minimum of five years, as required for tax or accounting purposes, or to comply with applicable financial regulations.

At the end of the applicable retention period, we follow detailed protocols to make sure that the Service Data is securely and completely deleted from our active systems (the servers Google uses to run applications and store data) or retained only in anonymized form. After completion of these steps, copies of Service Data will remain for a limited period in our encrypted backup systems (which we maintain to protect Service Data from accidental or malicious deletion and for outage and disaster recovery purposes), before being overwritten by new backup copies.

Your Google Account is your connection to all Google products and services, not just Cloud Services. When you choose to use Google products and services outside of Cloud Services, the Google Privacy Policy describes how your personal information (including your Google Account profile information) is collected and used. You and your administrator can control which other Google services you may use while logged into a Google Account managed by your organization.

If you interact with Cloud Services using a Google Account managed by your organization, then your personal information may be subject to your organizations privacy policies and processes, and you should direct privacy inquiries to your organization.

Exercising your data protection rights

If European Union (EU), UK or Swiss data protection law applies to the processing of Service Data relating to you, you have certain rights, including the rights to access, correct, delete and export your Service Data, and to object to or request that we restrict processing of your Service Data.

Google Cloud EMEA Ltd will be the data controller responsible for your Service Data. However, where our customer has entered into an agreement covering Cloud Services with a different Google affiliate, that affiliate will be the data controller responsible for processing your Service Data in connection with billing for the Cloud Services only.

If you want to exercise your data protection rights with regard to Service Data we process in accordance with this Privacy Notice, and you are not able to do so via the tools available to you or your organizations administrator, you can contact Google via our Privacy Help Center.

You can always contact your local data protection authority if you have concerns regarding your rights under local law.

Our grounds for processing your Service Data

When we process Service Data for the purposes described in this Privacy Notice (see "Why We Process Service Data above), we rely on the following legal grounds:

If you are using any Cloud Services subject to a Service Data Addendum, please review the Supplemental Google Cloud Privacy Notice for information about the legal grounds we rely on when processing your Service Data collected or generated from those Services.

Additional information (Switzerland)

If Swiss data protection law applies to the processing of your Service Data, the following additional information is relevant.

Please see the section titled Where Service Data is Stored (above) for information on where we and our affiliates process Service Data. We also disclose your Service Data to service providers, partners and other recipients (see the section titled How We Share Service Data) that are located or process information in any country in the world.

We comply with certain legal frameworks relating to the transfer of information as set out in our Legal Frameworks for Data Transfers page. We may also transfer your information to a third country based on an exception provided for by the Swiss Federal Data Protection Act.

An exception may apply in the event of legal proceedings abroad, in cases of overriding public interest or if the performance of a contract with you or in your interest requires disclosure, if you have consented, if the information has been made generally available by you and you have not objected to the processing, or the disclosure is necessary in order to protect the life or the physical integrity of you or a third party and we can't get consent within a reasonable period of time, or the information originates from a register provided for by Swiss law which is accessible to the public or to persons with a legitimate interest, provided that the legal conditions for the consultation of such register has been met in the specific case.

If Brazilian data protection law applies to the processing of Service Data, you have certain rights, including the rights to access, correct, delete or export your Service Data, as well as to object to or request that we restrict processing of Service Data. You also have the right to object to the processing of Service Data or to export Service Data to another service.

For users based in Brazil, the data controller responsible for Service Data we collect for Google Workspace and Google Workspace for Education is Google LLC, and the data controller responsible for Service Data we collect for Google Cloud Platform is Cloud Brasil Computao e Servios de Dados Ltda. The Data Protection Officer is Kristie Chon Flynn. If you want to exercise your data protection rights with regard to Service Data we process in accordance with this Privacy Notice and are not able to do so via the tools available to you or your organizations administrator, you can always contact Google via our Privacy Help Center. And you can contact your data protection authority if you have concerns regarding your rights under Brazilian law.

In addition to the purposes and grounds described in this Privacy Notice, we may process Service Data on the following legal grounds:

• Where necessary for the performance of a contract with you

  We may process your information where necessary for us to enter into a contract with you or to comply with our contractual commitments to you.

• When were complying with legal obligations

  Well process your information when we have a legal obligation to do so.

• When were pursuing legitimate interests

  We may process Service Data based on our legitimate interests and those of third parties while applying appropriate safeguards that protect your privacy. This means that we process your information in the interests of providing Cloud Services you request; making recommendations to optimize use of Cloud Services; maintaining and improving Cloud Services; providing and improving other services you request; assisting you; and protecting against harm to the rights, property or safety of Google, our users, our customers, and the public, as required or permitted by law.

Some U.S. state privacy laws require specific disclosures.

These laws may include:

• California Consumer Privacy Act (CCPA);
• Virginia Consumer Data Protection Act (VCDPA);
• Colorado Privacy Act (CPA);
• Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA);
• Utah Consumer Privacy Act (UCPA)
• Florida Digital Bill of Rights (FDBR);
• Texas Data Privacy and Security Act (TDPSA);
• Oregon Consumer Privacy Act (OCPA); and
• Montana Consumer Data Privacy Act (MTCDPA).

This Privacy Notice is designed to help you understand how Google handles Service Data:

• We explain the categories of Service Data Google collects and the sources of that Service Data in Service Data We Collect.

• We explain the purposes for which Google collects and uses Service Data in Why We Process Service Data.

• We explain when Google may disclose Service Data in How We Share Service Data. Google does not sell your Service Data to any third parties. Google also does not share your Service Data as that term is defined in the California Consumer Privacy Act (CCPA).

• We explain how Google retains Service Data in Retention and Deletion of Service Data. We maintain policies and technical measures to avoid re-identifying that information.

U.S. state privacy laws also provide the right to request information about how Google collects, uses, and discloses Service Data. And they give you the right to access your Service Data, sometimes in a portable format; correct Service Data; and to request that Google delete that Service Data. They also provide the right to not be discriminated against for exercising these privacy rights.

We provide the information and tools described in Access to Service Data so you can exercise these rights. When you use them, well validate your request by verifying your identity (for example, by confirming that youre signed in to your Google Account).

If you have questions or requests related to your rights under U.S. state privacy laws, you (or your authorized agent) can also contact Google. And if you disagree with the decision on your request, you can ask Google to reconsider it by responding to our email.

Some U.S. state privacy laws require a description of Service Data practices using specific categories. This table uses these categories to organize the information in this Privacy Notice.

Data protection laws in certain countries in this region may, in some cases, require Google to obtain your consent to collect and process your Service Data. By accessing and using any of the Cloud Services, you agree that Google may process your Service Data in accordance with this Privacy Notice. In particular, you can find information about:

• The categories of Service Data Google collects and the sources of that Service Data in Service Data We Collect.
• The purposes for which Google collects and uses Service Data in Why We Process Service Data.
• When Google may disclose Service Data in How We Share Service Data.
• How you can access Service Data relating to you in Access to Service Data.
• How Google retains Service Data in Retention and Deletion of Service Data.

If Korean data protection law applies to the processing of your Service Data, we provide the following additional information for users of Cloud Services residing in Korea.

Items of personal information collected. When you use our Cloud Services, the following Service Data is collected: (i) data you provide when creating an account for Cloud Services or entering into a contract with us (credentials, names, contact details, job titles, date of birth and gender), (ii) business records of charges, payments, billing details and issues; credit card info and connecting info (iii) configuration and settings, including resource identifiers and attributes, and service and security settings, (iv) usage, operational status, software errors and crash reports, authentication credentials, quality and performance metrics, and other technical details, device identifiers, identifiers from cookies or tokens, and IP addresses), (v) your communications and interactions with us and our partners, and feedback, each as further described here.

The personal information listed in (i) to (v) above may be transmitted to our data centers located abroad through our network, as described in Purposes of collection and use of personal information below and stored for the retention period described in Retention period and deletion of personal information below. If you do not want your personal information to be transferred overseas, you may refrain from using services and not provide your personal information. However, services may not be provided or may be limited. If you have any questions about this, please see the Contact Information below.

We may use cookies (small text files placed on the user's device) and similar technologies for a variety of purposes, including user preferences or settings, authentication information or analysis. Most web browsers accept cookies automatically, but provide controls that allow you to block or delete cookies.

Purpose of collection and use of personal information. Google collects and uses Service Data (i) to provide Cloud Services you request, (ii) to make recommendations to optimize use of Cloud Services, (iii) to maintain and improve Cloud Services, (iv) to provide and improve other services you request (v) to assist you, (vi) to protect you, our users, customers, the public and Google, and (vii) to comply with legal obligations, each as further described here.

Retention period and deletion of personal information. We retain Service Data only for as long as necessary to fulfill the purposes of collection and use described above. For each type of data and operation, we set retention timeframes based on the purpose for its collection, and ensure it is kept for no longer than necessary.

If the retention period expires or you request deletion, Google will faithfully endeavor to delete or anonymize such Service Data unless there is a legal obligation that requires processing or another lawful basis for retaining the Service Data. When we receive a request to delete Service Data, the retention period of the archive copy expires, and then Google's archiving system has a mechanism to overwrite the expired data.

We retain most types of Service Data for a set period of up to 180 days (the exact number depends on the specific type of data). However, we generally have longer retention periods (which can be over a year) for Service Data that is kept for (i) Security, fraud and abuse prevention, (ii) complying with legal or regulatory requirements including the Communications Secrets Protection Act. We also have retention periods of a minimum of five years for Service Data about payments and billing information for complying with tax, accounting or financial requirements, each as further described here.

Consignment of personal information processing. We provide information to affiliates (listed here for Google Cloud Platform, and here for Google Workspace and Google Workspace for Education), partners and other trusted businesses or persons to process it for us, based on our instructions and in compliance with this Privacy Notice and other appropriate confidentiality and security measures.

Google has contracts with the third-party service providers listed below to provide Cloud Services to Korean residents. The contracts impose obligations on those companies to prohibit the processing of Service Data other than for the purposes we specify, to return or destroy Service Data after the end of processing, and to implement processes to ensure those companies comply with these obligations.  

Legal minors. Our basic policy for Google Cloud Platform is not to collect personal information of Korean residents under the age of 14. If you are Korean residents under the age of 14, you may use certain Cloud Services only with the consent of a parent or legal representative.

Safety measures for personal information. Google takes the administrative, technical and physical measures described in the "How We Secure Service Data" section above to ensure the safety of Service Data.

Contact Information. If you have any questions about the Google Cloud Privacy Notice or Googles privacy practices including how to exercise rights such as access to personal information, correction/deletion, processing suspension, and withdrawal of consent, please contact our Google privacy team (Email: googlekrsupport@google.com).

If you want to exercise your data protection rights with regard to Service Data we process in accordance with this Privacy Notice and are not able to do so via the tools available to you or your organizations administrator, you can always contact Google via our Privacy Help Center. And you can contact your local data protection authority (for instance, Personal Information Infringement Report Center) if you have concerns regarding your rights under Korean privacy law.

For local representatives under Personal Information Protection Act and the Act on Promotion of Information and Communication Network Utilization and Information Protection, please see below:

• Name and Representative: Google Korea LLC (Representative Director Nancy Mable Walker Buma)
• Address and Contact Information: 22nd floor, 152 Teheran-ro, Gangnam-gu, Seoul, Google Korea LLC, 02-531-9000, data-access-requests@google.com

If Japanese data protection law (the Act on the Protection of Personal Information, APPI) applies to the processing of your Service Data, we provide the following additional information for users of Cloud Services residing in Japan.

Controller of Service Data. Any Service Data provided to or gathered by Google is controlled primarily by Google LLC, located at 1600 Amphitheatre Parkway Mountain View, CA 94043 United States, representative is Sundar Pichai, CEO.

Purpose of collection and use of personal information. Google collects and uses Services Data for the purposes set out here and here.

Measures undertaken to protect retained personal information. 

Establishment of general policy

Google establishes and publishes this Privacy Notice outlining our general policy relating to Service Data.

Establishment of internal policy relating to handling of personal data

Google establishes internal policies about handling measures and persons in charge and their responsibility etc. with regard to the acquisition, utilization, records, provision, deletion etc. of personal data.

Internal organization as security control action

Google has large security and privacy teams responsible for developing, implementing, and reviewing internal personal data handling processes. Google employees are trained to report suspected incidents involving personal data, which may be done through various channels such as through dedicated email addresses or digital platforms. A dedicated team assesses reported incidents, and as appropriate a coordinated team is assigned to manage the overall incident, including liaising with Legal and the product team as part of the investigation and response. The team on-call for an incident is assigned on a daily rotation. Incident responses may follow either a standard or an expedited route, depending on the severity and priority assigned to the incident.

Personnel measures as security control action

Google conducts periodical training for its employees about matters to consider when handling personal data.

Physical measures as security control action

Google takes measures to prevent unauthorized persons from accessing personal data in any situation and to prevent theft or loss of devices and electronic media for handling personal data.

Technical measures as security control action

Please see here and here for further information on the security measures undertaken to secure, retain and delete Service Data

Research of external environment

Data protection laws vary among countries, with some providing more protection than others. Google has established a personal information protection system to ensure your information is accorded protections equivalent to APPI, as described in the Privacy Notice. Regardless of where your information is processed, Google applies the same personal information protection measures globally. We also comply with certain legal frameworks relating to the transfer of data, such as the European frameworks. For more detail, please see Data transfer frameworks. Further, with regard to the location of our data centers storing Service Data, please see here. There may be cases where Google entrusts the processing of information to subprocessors or its subsidiaries or affiliates. With regard to the location of Googles offices including subsidiaries and affiliates, please see Googles Office Locations. With regard to the location of subprocessors, please see here.

Contact information. For any inquiries or requests about your Service Data related rights under applicable law, please email appi-inquiries-external@google.com.

We may update this Privacy Notice from time to time. We will not make any significant changes without notifying you in advance by posting a prominent notice on this page describing the changes or by sending you a direct communication. We encourage you to regularly review this Privacy Notice, and we will always indicate the date the last changes were published.