Data Privacy Framework Policy

SoundHound complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF,  and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF”) as set forth by the US Department of Commerce. SoundHound has certified that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. SoundHound has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy, the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (collectively, the “DPF Principles”), the DPF Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov.

This Data Privacy Framework Policy supplements our Privacy Policy. Capitalized terms used in this Data Privacy Framework Policy have the meaning given to them by our Privacy Policy, unless specifically defined in this Policy. In case of conflict between our Privacy Policy and this Policy with regard to our privacy practices under the DPF, this Policy prevails. This Policy applies to SoundHound, which is subject to the investigatory and enforcement powers of the Federal Trade Commission.

Personal Information Received from the European Economic Area, the United Kingdom & Switzerland

SoundHound may receive from the EEA, the United Kingdom and Switzerland some or all of the information listed in our Privacy Policy. Some of that information may qualify as “personal information” or “personal data” (collectively, “Personal Information”) as defined in the DPF Principles. To the extent that SoundHound receives Personal Information from the EEA, the United Kingdom and Switzerland in reliance on the DPF, SoundHound will handle such Personal Information in accordance with the DPF Principles.

How We Obtain Personal Information

We obtain and process Personal Information in different capacities.

As a data controller, we collect and process Personal Information from the EEA, the United Kingdom and Switzerland directly from individuals as set forth in our Privacy Policy.

As a data processor, we process Personal Information from the EEA, the United Kingdom and Switzerland, as provided to us by data controllers (i.e., our commercial customers) (“Hosted Data”) in order to provide them with our services (Voice-Enabled Solutions). In that context, we only process Personal Information on behalf of and at the direction of our commercial customers (Third Party Controllers). The Privacy Policy sets out the roles and responsibilities of our commercial customers, as controllers, and us, as processor, for the processing of Personal Information.

For all types of processing, SoundHound commits to the DPF Principles with respect to all Personal Information received from the EEA, the United Kingdom and Switzerland.

Notice

We provide information regarding our privacy practices in our Privacy Policy.

When we process Hosted Data, the Third Party Controllers determine the categories of data they upload in our systems and the purposes of the processing. For example, our commercial customers may upload data directly or through a service provider, various businesses and IT cost, value and utilization data at their own discretion. Accordingly, our Third Party Controllers are responsible for providing notice to individuals and you should review their privacy policies for more information regarding their data processing practices.

Data Integrity and Purpose Limitation

SoundHound may use the Personal Information it receives from the EEA, the United Kingdom and Switzerland for the purposes set forth in our Privacy Policy or as you may otherwise be notified. We take reasonable steps to ensure that the Personal Information we process is reliable for its intended use, accurate, complete, and current to the extent necessary for the purposes for which we use the Personal Information. We will not process Personal Information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by you. We will adhere to the DPF Principles for as long as we retain the Personal Information collected under the DPF.

Onward Transfers

Our Privacy Policy describes the circumstances in which we may disclose your information to third parties. We remain responsible for the processing of Personal Information received under the DPF and subsequently transferred to a third party acting as an agent if the agent processes such Personal Information in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage. We may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Data Security

We use reasonable and appropriate measures to protect your Personal Information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Information.

Choice

We will give you an opportunity to choose whether your Personal Information may be used for a purpose that is materially different from the purposes for which it was originally collected or subsequently authorized by you, or if we intend to disclose it to a third party acting as a data controller that we have not previously disclosed to you. In such circumstances, we will notify you and offer you the opportunity to opt-out of such uses and/or disclosures where non-sensitive Personal Information is involved, and to opt-in where sensitive Personal Information is involved.  To request to limit the use and disclosure of your personal information, please submit a written request to [email protected].

Access to Personal Information

Pursuant to the DPF Principles, EU, United Kingdom and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States.  Where appropriate, SoundHound will provide you with access to the Personal Information that we maintain about you. SoundHound will also correct, amend or delete Personal Information that we maintain about you when it is inaccurate or has been processed in violation of the DPF Principles and you send a written request to us using the information provided in the “Contact Information” section below. We will review your request in accordance with the DPF Principles, and may limit or deny access to Personal Information where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the DPF Principles.

When we process Hosted Data, Third Party Controllers control the type of information we obtain, how that information is used and disclosed, and how it can be modified. Accordingly, if you wish to request access, limit use or disclosure of your Personal Information, please contact the Third Party Controller(s) that submitted your data to us. If you provide us with the name(s) of the Third Party Controller(s), we will refer your request to those Third Party Controller(s), and will support them as needed in responding to your request.

Recourse and Enforcement

We conduct an annual self-assessment of our Personal Information practices to verify that the attestations and assertions made in this Policy are true and have been implemented as represented.

If you have any questions or concerns, we encourage you to first write to us at the address listed below. We will investigate and attempt to resolve any complaints or disputes regarding our use and disclosure of Personal Information in accordance with the DPF Principles.

If an issue cannot be resolved through our internal dispute resolution mechanism, SoundHound has further committed to refer unresolved privacy complaints under the DPF  Principles to an independent dispute resolution mechanism, JAMS DPF Dispute Resolution. Please visit https://www.jamsadr.com/eu-us-data-privacy-framework to file a claim. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms.  See DPF Annex 1 at https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2

Contact Information

If you have questions, concerns, or complaints about this DPF Policy or SoundHound’s privacy practices, or if you would like to exercise your rights and choices with regard to your Personal Information, please contact us by email at [email protected].

Data Protection Framework Policy Changes

This Policy may be changed from time to time, consistent with the requirements of the DPF. You can determine when this Policy was last revised by referring to the “Last Updated” legend at the bottom of this Policy. Any changes to this Policy will become effective when posted to our website. when this Policy was last revised by referring to the “Last Updated” legend at the top of this Policy. Any changes to this Policy will become effective when posted to our website.