We collect personal data if required to provide our programs, products or services, fulfil our legitimate business purposes and/or comply with applicable laws and regulations. Where this concept is recognized under applicable law, the legal basis for processing in the following instances will be as a result of expectation of contractual arrangements, statutory or regulatory requirements and the furtherance of HPE’s legitimate interests. This may be supported by additional information to assist with obtaining specific consents where required. Depending on your relationship with HPE we collect and process your personal data as follows: 

In some cases, the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter or fulfil a contract with HPE. If you refuse to provide your personal data in such cases, we may not be able to provide you with the full functionality of our programs, services or products.

Non-HPE web sites and social media features. HPE sites or services may provide links to third-party applications, products, services or websites for your convenience or information. We may also provide social media features that enable you to share information with your social networks and to interact with HPE on various social media sites. HPE does not control third party sites, or their privacy practices and we do not endorse or make any representations about third party sites. The personal data you choose to provide to or that is collected or shared by these third parties is not covered by this Privacy Statement. We encourage you to review the privacy notice of any site you interact with, before allowing the collection and use of your personal data.

Transfers to service providers or third parties. With respect to transfers to service providers or third parties located in countries which do not provide an adequate level of data protection, HPE will take appropriate safeguards such as signing EU Standard Contractual Clauses, or equivalent contractual mechanisms approved by the relevant data protection authority, with the recipient, relying on approved codes of conduct or certification mechanisms adopted by the recipient or binding and enforceable commitments of the recipient. If you would like to receive more information about the appropriate safeguards and/or receive a copy of the relevant mechanism for your review, please contact the HPE Privacy Office.

HPE may provide you with information that complements our programs, products and services and/or communications about our new programs, products, services and offers. If you or your organization purchased our programs, products or services, you may receive alerts, software updates or responses to support requests that are part of our programs, products and services. If you choose to receive HPE communications, you may also choose to subscribe to receive specific newsletters and publications. In some cases, you may also choose whether to receive the information and communication by email, telephone, or post.

Manage communication choices. You can change your choices and preferences relating to HPE communications by: 

• Accessing online—Get connected with updates from HPE, indicating or changing your preferences and providing your email address;
• Accessing services via single sign on (SSO) that lets you register with HPE enabled websites using a single user identifier and password of your choice and allows you to set your privacy preferences for email and telephone contact from HPE.

Unsubscribe from communications. In the event you no longer wish to receive HPE communications, you can unsubscribe from such communications by: 

• Following the opt-out or unsubscribe link and/or instructions included in each email subscription communication;
  
• Accessing the Communication preference center, selecting “Unsubscribe” and providing your email address;
• Indicating to the caller that you do not wish to receive calls from HPE anymore. In the event your opt-out or unsubscribe request has not been resolved in a timely manner, please contact the HPE Privacy Office with details of your name, contact information, and description of the communications you no longer wish to receive from HPE. Please note that there might be a delay until your request is processed. This may include needing to verify your request;
• Sending us a communication via hpeprivacy@hpe.com that you no longer wish to receive direct mail.

Please note: where the primary purpose of our communications is not promotional in nature, such as contact relating to the administration of your relationship with us, such as through orders, contracts, support, product safety warnings, or other administrative and transactional notices, we may need to contact you. 

HPE takes seriously the trust you place in us to protect your personal data. To protect your personal data from loss, or unauthorized use, access or disclosure, HPE utilizes reasonable and appropriate physical, technical, and administrative procedures to safeguard the information we collect and process. HPE aligns with security by design principles in its cybersecurity program. All systems used to support HPE’s business are governed by HPE’s corporate Cybersecurity policies, which are built upon industry standards and best practices like the International Organization for Standardization (ISO) 27001 family of standards and National Institute of Standards and Technology (NIST) standards.

When collecting or transferring sensitive information we use a variety of additional security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. The personal data you provide us with is stored on computer systems locked in controlled facilities which have limited access. Access to your information is restricted to HPE employees or authorized third parties who need to know that information to process it for us, and who are subject to strict confidentiality obligations. When we transmit sensitive information, we protect it through the use of encryption, such as the Transport Layer Security (TLS), Internet Protocol Security (IPSec), or Secure Socket Layer (SSL).

We keep personal data for the length of the contractual relationship and, to the extent permitted by applicable laws, after the end of that relationship, for as long as is reasonably necessary to perform purposes set out in this Privacy Statement, to protect HPE from legal claims and administer our business. HPE expressly reserves the right to use the content on this website for commercial text and data mining with respect to use by artificial intelligence and machine learning query tools as set out in regional and national implementations. For the acquisition of a corresponding license of use, please contact hpeprivacy@hpe.com.

When we no longer need to use personal data, we will delete it from our systems and records or take steps to anonymize the data unless we need to keep it longer to comply with a legal or regulatory obligation. If you would like to receive more information about our data retention policies, please contact the HPE Privacy Office.

To determine the appropriate retention period for Personal Information, we will consider the amount, nature and sensitivity of the data, the purposes for which we process personal data and whether these purposes can be achieved through other means, as well as any applicable legal obligations. Retention periods will be determined on a case-by-case basis, in line with HPE’s standards of business conduct and risk management.

Our privacy practices are aligned with the requirements of applicable data protection laws of countries in which we operate. We respect the rights individuals have in relation to their personal data under these laws. Depending on what data protection laws you are subject to, this additional information may be relevant and applicable to you.

Data controllers. Companies from the HPE group of entities may act as data controllers or equivalent in relation to your personal data for the processing of personal data described in this Privacy Statement. You can find the up-to-date list of the HPE group of entities by clicking here. If you would like to receive more information about which HPE entity acts as data controller for your personal data, please contact the HPE Privacy Office.

Chief Privacy Officer. HPE has appointed a Chief Privacy Officer (CPO), who also acts as the local Data Protection Officer (DPO) in many countries we operate in. We also have local Data Protection Officers in certain countries, such as Germany and Poland. You can contact the CPO/DPO by completing the form available here or in writing to:

Hewlett Packard Enterprise
Office of Legal & Administrative Affairs—ATTENTION PRIVACY OFFICE
1701 E Mossy Oaks Rd
Spring, TX 77389

Legal basis to process personal data. Where this concept is recognized, we process your personal data on the following legal bases:

• Legitimate Interest. We may process your personal data as required to pursue our legitimate business interests (provided this is not overridden by interests or rights of relevant individuals). In particular, we use it to manage, develop and improve our programs, products and services; support our customers and sales operations; protect our staff and assets; communicate information that supplements our programs, products and services and ensure compliance with laws and regulations. Our legitimate business interests correlate with the purposes for processing set forth in the “How we use personal data” section above.
• Performance of an agreement. We may process your personal data to enter into or fulfil agreements with you or your organizations, including to deliver and manage our programs, products and services and allow our customers to use our programs, products, services and supporting tools. 
• Legal obligation. We may process your personal data to comply with applicable laws and regulations, establish or exercise our legal rights. For example, this may be in connection with legal claims, compliance, regulatory and investigative purposes. 
• Consent. We may process your personal data where you have provided your consent, which you may withdraw at any time and will seek explicit consent where we may need to process sensitive personal data. Your right to withdraw consent will not affect the lawfulness of processing based on consent before its withdrawal. Consent will form the legal basis for processing personal data where we cannot rely on an alternative legal basis or we are required by law to ask for your consent in the context of some of our sales and marketing activities, online data collection tools, or surveys. At any time, you have a right to change your communication choices, unsubscribing from HPE communications or contacting the HPE Privacy Office.

Your rights in relation to your personal data. Depending on what data protection laws you are subject to, you may have the right to request to:

• Confirm the processing of your data, access or obtain copies of personal data HPE processes about you;
• Rectify your personal data, if inaccurate or incomplete;
• Delete or anonymize your personal data, unless an exception applies. For instance, we may need to keep your personal data to comply with legal obligation;
• Restrict the processing of your personal data in certain circumstances. For instance, if you contest the accuracy of your personal data, you may request that we restrict processing of your personal data for the time enabling us to verify the accuracy of your personal data;
• Request to limit certain uses and disclosures of your sensitive personal information;
• Opt-out of the sharing of your personal data for purposes of behavioral advertising;
• Data portability, in certain circumstances. For example, you may request us to transmit some of your personal data to another organization if the processing is based on your consent or a contract;
• Object to processing of your personal data, in certain circumstances. For example, you may object to direct marketing including use of your personal data for profiling for direct marketing or where we process your personal data because we have legitimate interest in doing so;
• Obtain information about the entities with which HPE has shared your personal data;
• Withdraw consent to the processing of your personal data.

Certain US residents may be able to opt-out from the “sharing” of personal information, i.e. our use of optional automatic data collection tools, by visiting the “Do not sell my personal information” page.

These rights may be limited in some situations such as where HPE can demonstrate that HPE has a legal requirement or legitimate interest to process your personal data or can legitimately apply an exemption to the exercise of a right under applicable law. 

To view and update the personal data you provided directly to HPE, you can return to the web page where you originally submitted your data and follow the instructions on that web page, using single sign on (SSO) where enabled. Otherwise, please contact us by completing the form available here or by writing to the CPO at the address indicated in the Chief Privacy Officer section above. To protect your privacy and security, we will take reasonable steps to verify your identity before processing your request.

Complaint with a supervisory authority. If you consider that the processing of your personal data infringes applicable data protection laws, you may have a right to lodge a complaint with a supervisory authority in the country where you live, or work, or where you consider that data protection rules have been breached. 

Your rights under HPE Binding Corporate Rules. You may have additional rights under our BCRs. For example, where you believe your personal data has been transferred by an HPE entity and processed by that entity in breach of the BCR, you may have a right to: 

• Lodge a complaint with the HPE entity which transferred your personal data;
• Lodge a complaint with a supervisory authority located in the same country as the HPE entity which transferred your data; 
• Bring a court action against the HPE entity which transferred your personal data.

If HPE processes your personal data on behalf of an HPE customer, then we will, in the first instance, refer your complaint to our customer to handle. 

For further information, please visit the HPE BCR web page available here.

Please click here to access translations of this Privacy Statement and any country specific supplements.

Please click here for the US Addendum.