Understand policy risk. Ask policy questions in plain language. Request a demo →

Product and Services Privacy Notice

FireMon, LLC (“FireMon” or “we”) respects your privacy and is committed to protecting it through our compliance with this Product and Services Privacy Notice. This Product and Services Privacy Notice also describes FireMon’s privacy practices relating to Personal Data received in reliance on the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), as applicable. FireMon complies with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. FireMon has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. FireMon has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Product and Services Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Principles shall govern. To learn more about the Data Privacy Framework Program, and to view FireMon’s certification, please visit https://www.dataprivacyframework.gov.

This Product and Services Privacy Notice describes the types of information FireMon may process in connection with FireMon products, software, hardware, Cloud Services, Support Services, Insights Analytics, User Center interactions, and related offerings, including Telemetry Data, which is the umbrella category for KPI Data, chatbot or retrieval-augmented generation (“RAG”) session data, and raw Policy Manager data temporarily processed in connection with the applicable products or services, and FireMon’s practices for collecting, using, maintaining, protecting, disclosing, transferring, and retaining that information, including where applicable Personal Data received in the United States under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

This Product and Services Privacy Notice also describes how FireMon treats technical product information, support artifacts, logs, configuration data, diagnostic data, and Telemetry Data, including KPI Data, chatbot or retrieval-augmented generation (“RAG”) session data, and raw Policy Manager data temporarily processed in connection with certain products or services.

This Product and Services Privacy Notice does not apply to FireMon public-facing websites, marketing pages, or cookie-based website interactions, which are addressed in the separate FireMon Privacy Policy.

Where a contract between FireMon and a customer governs the applicable products or services, that contract will control to the extent of any conflict with this Product and Services Privacy Notice.

Where FireMon receives Personal Data in the United States in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, FireMon will process such Personal Data in accordance with the applicable DPF Principles. FireMon is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its compliance with the applicable DPF Principles.

Please read this Product and Services Privacy Notice carefully to understand our policies and practices regarding information processed in connection with FireMon products and services and how we will treat it. This Product and Services Privacy Notice may change from time to time. If we make material changes, we may provide notice through the applicable product, service, customer communications, or by other appropriate means.

Your continued use of the applicable products or services after such changes become effective is subject to the governing contract and applicable law, so please review this Product and Services Privacy Notice periodically for updates.

This Product and Services Privacy Notice Applies to Information We Process:

  • In connection with FireMon software products, hardware, Cloud Services, hosted offerings, User Center, and related products and services.
  • In email, text, in-product, portal-based, User Center, chatbot-enabled, and other electronic or support-channel communications relating to contract administration, account administration, implementation, maintenance, and Support Services.
  • Through mobile, desktop, virtual, appliance-based, web-based, or other software applications, interfaces, and support or administrative tools that are part of, or interact with, FireMon products or services.
  • When FireMon products or services interoperate with third-party systems, environments, integrations, or service providers at the direction of the customer or as part of FireMon’s provision of the applicable products or services.

It Does Not Apply to Information Processed:

  • Through FireMon public-facing websites, marketing pages, recruiting pages, event pages, or cookie-based website interactions, except to the extent the same interaction also involves contract administration, account administration, or Support Services for FireMon products or services.
  • By or on behalf of a customer where FireMon acts solely as a service provider, processor, or similar role under the applicable contract, except to the extent this Product and Services Privacy Notice describes FireMon’s own handling of information for service delivery, security, troubleshooting, contract administration, account administration, legal compliance, or other legitimate business operations.
  • Directly by unaffiliated third parties through their own applications, infrastructure, content, or services, except to the extent FireMon receives or discloses information as part of providing the applicable products or services.

Information We Process and How We Process It

We process several types of information in connection with FireMon products and services, and from individuals who interact with us in connection with contract administration, account administration, implementation, User Center activities, and Support Services, including information:

  • By which an individual may be personally identified, such as name, business contact information, postal address, e-mail address, telephone number, account credentials, support request information, ticket content, technical product information, support artifacts, logs, configuration files, diagnostic files, and similar records. FireMon uses this information as Personal Data only to the limited extent needed for contract administration, account administration, implementation, security, legal compliance, and Support Services.
  • In some circumstances, technical records processed through FireMon products or services may contain incidental identifiers, such as IP addresses, device identifiers, usernames, hostnames, or similar values, but FireMon does not treat Telemetry Data, including KPI Data, as a means to identify or track individuals except as necessary for contract administration, account administration, implementation, security, legal compliance, and Support Services.
  • Technical, operational, configuration, usage, performance, and security-related information generated by or relating to FireMon products and services, including technical product information, support artifacts, logs, alerts, event records, diagnostic data, product configuration data, and Telemetry Data. For purposes of this Product and Services Privacy Notice, Telemetry Data is the umbrella category for such technical and operational information and includes KPI Data, chatbot or RAG session data, and raw Policy Manager data that is temporarily processed in connection with the applicable products or services. FireMon may process this information to operate, secure, maintain, support, troubleshoot, improve, and provide the applicable products and services, including Insights Analytics. FireMon does not use Telemetry Data, including KPI Data, to identify, track, profile, monitor, target, retrieve, or report on individuals or IP addresses, and does not maintain Telemetry Data, including KPI Data, for individual-level identification or behavioral tracking. Any incidental identifiers contained in Telemetry Data, including KPI Data, or related technical records are treated as technical artifacts rather than as data elements used to identify a person, except to the limited extent necessary for contract administration, account administration, Support Services, service operation, security, troubleshooting, fraud prevention, legal compliance, or as otherwise permitted by the applicable contract.
  • Raw Policy Manager data submitted by or on behalf of a customer may contain customer-defined content or identifiers and, when temporarily processed in connection with the applicable products or services, forms part of Telemetry Data, but is handled separately from retained aggregated or derived analytics outputs.
  • Where FireMon offers chatbot or RAG-enabled functionality, prompts, responses, retrieved content, and related service records form part of Telemetry Data and are processed separately from raw Policy Manager data unless the applicable feature, configuration, or customer instruction expressly causes such data to be included.

We process this information:

  • Directly from customers, users, administrators, and other individuals when they provide it to us or interact with FireMon products or services.
  • Automatically through the operation of FireMon products and services, including through User Center activity, service logs, telemetry, diagnostics, performance monitoring, and security-related events.
  • From third parties, such as customers, resellers, implementation partners, integration partners, subprocessors, and service providers.

How We Use Information

FireMon uses information processed in connection with its products and services to provide, administer, secure, maintain, troubleshoot, analyze, improve, and support those products and services. These uses may include:

  • Providing the requested products and services and performing the applicable contract.
  • Managing customer accounts, licenses, billing-related administration, User Center administration, service communications, and Support Services.
  • Producing service metrics, operational reporting, Insights Analytics, and other analytics derived from Telemetry Data, including KPI Data, and related technical records, provided that FireMon does not use such data for individual identification or cross-context tracking.
  • Detecting, preventing, investigating, and addressing security incidents, fraud, misuse, product defects, service issues, and legal or regulatory compliance obligations.

Telemetry Data and KPI Data Treatment

FireMon applies the following practices to Telemetry Data, including KPI Data, processed in connection with FireMon products and services:

  • FireMon does not use Telemetry Data, including KPI Data, to identify, track, profile, monitor, target, retrieve, or report on individuals or IP addresses in the ordinary course of business.

If Telemetry Data, including KPI Data, or related technical records contain incidental identifiers, FireMon treats those values as technical artifacts used for service operation, security, troubleshooting, support, legal compliance, or contract/account administration, and not as data maintained for individual-level profiling or tracking.

  • If Cloud Services Telemetry Data, Telemetry Data, KPI Data, or related technical records contain incidental identifiers, FireMon treats those values as technical artifacts used for service operation, security, troubleshooting, support, legal compliance, or contract/account administration, and not as data maintained for individual-level profiling or tracking.

Support Services, User Center, and Diagnostic Handling

In connection with Support Services, FireMon may process contact details, case records, communications, screenshots, logs, configuration exports, diagnostic files, and other materials submitted by or on behalf of a customer. Such materials may include raw Policy Manager data or other customer content.

FireMon uses these materials only as reasonably necessary to investigate, reproduce, diagnose, remediate, and document support issues; to maintain service quality and security; and to meet legal or contractual obligations.

Unless a longer period is required for security, legal, contractual, or evidentiary reasons, FireMon retains support case materials and diagnostic records only for so long as needed for the relevant support purpose and then deletes, anonymizes, or otherwise disposes of them in accordance with its retention practices.

Privacy Rights, DPF Rights, and Requests

Depending on applicable law and the context in which information is processed, individuals may have rights regarding their Personal Data, such as rights to access, correct, delete, restrict, object, or request portability. Where FireMon processes Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, individuals may also have the right to obtain confirmation of whether FireMon maintains Personal Data relating to them and to access such Personal Data, and may request that FireMon correct, amend, or delete Personal Data where it is inaccurate or has been processed in violation of the applicable DPF Principles, subject to the conditions and limitations of those Principles. In most cases, FireMon processes product and service data on behalf of a customer, and the customer is the appropriate party to respond to the request in the first instance.

Where FireMon acts as a controller or otherwise has direct obligations regarding the relevant Personal Data, FireMon will handle requests in accordance with applicable law and, where applicable, the relevant DPF Principles. Rights relating to product and services specific technical records may be limited where FireMon cannot reasonably associate the relevant records with an identified individual or where FireMon processes the information only on behalf of a customer, subject in each case to applicable law.

If your request relates to information processed by FireMon on behalf of a customer in connection with FireMon products or services, including User Center, support-channel, or support case records, please direct your request to the relevant customer first.

If FireMon cannot reasonably identify you from Telemetry Data, including KPI Data, or other technical records without obtaining additional information, FireMon is not obligated to maintain, acquire, or process additional identifying information solely for the purpose of responding to your request, except as required by applicable law.

FireMon may require verification of identity and sufficient information to understand, evaluate, and respond to a request.

FireMon will not discriminate against an individual for exercising privacy rights available under applicable law.

To submit a privacy request relating to this Product and Services Privacy Notice, or to make an inquiry or complaint relating to FireMon’s handling of Personal Data under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, contact privacy@firemon.com or legal@firemon.com.

If you have a complaint relating to FireMon’s handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, you should first contact FireMon at privacy@firemon.com and we will investigate and attempt to resolve the issue. If a complaint cannot be resolved through FireMon’s internal processes, FireMon has committed to refer unresolved complaints concerning Personal Data received in reliance on the applicable DPF Principles to JAMS, an independent dispute resolution provider based in the United States, at no cost to the individual. You may learn more about JAMS and submit a DPF-related complaint at https://www.jamsadr.com/DPF-Dispute-Resolution.

Under certain conditions, an individual may invoke binding arbitration to address residual claims regarding Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF that have not been resolved by other applicable DPF recourse mechanisms.

International Processing

FireMon and its service providers may process information, including Telemetry Data, in the United States and in other countries where FireMon or its subprocessors operate. Those countries may have data protection laws that differ from those in the jurisdiction where the information originated. Where required by applicable law, FireMon will use appropriate safeguards for cross-border transfers of Personal Data. In addition, where FireMon receives Personal Data in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, FireMon may be required to disclose such Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Data Security and Retention

FireMon implements administrative, technical, and organizational measures designed to secure confidential information, including Personal Data, against accidental or unlawful loss, unauthorized access, use, alteration, and disclosure.

FireMon uses identifiable Personal Data as Personal Data only where needed for contract administration, account administration, implementation, security, legal compliance, and Support Services.

By contrast, where FireMon processes Telemetry Data, including KPI Data, User Center records, support artifacts, and related technical records, FireMon does not use that data to identify, track, profile, monitor, target, retrieve, or report on individuals or IP addresses, except as necessary for service operation, security, troubleshooting, fraud prevention, legal compliance, or as otherwise permitted by the applicable contract.

FireMon retains product and services specific information, including Telemetry Data, for as long as reasonably necessary for the purposes described in this Product and Services Privacy Notice, including service delivery, support, security, analytics operation, legal compliance, dispute resolution, and enforcement of contractual rights, after which FireMon deletes, anonymizes, or otherwise disposes of the information in accordance with its retention practices and applicable law.

Certain categories of Telemetry Data may be retained for different periods depending on the applicable product feature, support need, contractual requirements, security needs, or legal obligations. For example, KPI Data may be retained to support analytics and trend reporting for the applicable service period, chatbot or RAG interaction records may be retained for a shorter period consistent with the applicable feature and retention practices, and raw Policy Manager data temporarily processed in connection with chatbot, RAG, support, or other service functionality is not retained as KPI Data and may be retained only ephemerally or for so long as reasonably necessary for the relevant function.

FireMon may disclose or make information, including Telemetry Data, available to affiliates, subprocessors, and service providers that perform services on FireMon’s behalf, such as hosting providers, cloud infrastructure providers, customer support providers, analytics support providers, security providers, communications providers, User Center operations providers, chatbot or RAG support providers, professional services providers, implementation partners, and resellers, subject to appropriate contractual and confidentiality protections. FireMon discloses Personal Data to these categories of third parties for purposes including hosting, infrastructure, service delivery, account administration, contract administration, customer support, implementation, communications, analytics support, security operations, troubleshooting, professional services, and related business operations in connection with the applicable products and services. Where FireMon transfers Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF to a third party acting as an agent on FireMon’s behalf, FireMon will do so consistent with the applicable DPF Principles and remains liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless FireMon proves it is not responsible for the event giving rise to the damage.

FireMon may also disclose Personal Data to customers, administrators, authorized users, integration partners, and other third parties where necessary to provide the applicable products and services, to enable customer-directed integrations or interoperability, to respond to requests or instructions from the relevant customer, to comply with law, regulation, legal process, or valid governmental request, or to protect FireMon, its customers, users, or others.

FireMon may also disclose information where required by law, regulation, legal process, or valid governmental request, or where necessary to protect FireMon, its customers, users, or others.

Retention periods may vary depending on the nature of the data and the purpose of processing, including shorter retention for temporary diagnostic materials, support artifacts, and certain chatbot or RAG service records, and longer retention where required for security, legal, contractual, or evidentiary purposes.

Changes to This Product and Services Privacy Notice

FireMon posts any changes to this Product and Services Privacy Notice with an updated revision date. Material changes may also be communicated through the applicable products, services, customer communications, or other appropriate means.

Contact Information

For questions or requests regarding this Product and Services Privacy Notice, your personal information rights, or FireMon’s handling of Personal Data under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, contact us at privacy@firemon.com or legal@firemon.com.

Revision Date: October 1, 2026