NetApp Privacy Policy

Last Updated July 18, 2025

This Privacy Policy tells you about NetApp Inc. and its affiliated entities globally (together “NetApp”) and its policies and practices for the collection and use of your personal information.

The purpose of this Policy is to give you information about what personal information we collect, use, transfer and disclose, and our reasons for doing this. This Policy outlines the ways that you can manage your personal information. Certain privacy rights may be afforded to you based on where you are located. If you have any privacy related queries, you can contact the NetApp Privacy Legal team using the contact details listed in the Contact Us section below.

NetApp is committed to protecting your privacy and data protection rights and complying with our obligations under applicable privacy and data protection laws.

This Privacy Policy applies to all individuals for whom we collect and control their personal information in our role as a “data controller”. In other words, this Policy applies to personal information processed by NetApp for purposes determined by NetApp and explained in this Policy. NetApp may be the data controller of personal information such as customer or supplier contact details, certain limited device information when you access our digital properties, customer marketing leads or other data categories explained in this Policy where such personal information is processed by NetApp as a data controller.

The NetApp entity responsible for your personal information will depend on your location and the processing carried out. If you are based in the European Economic Area (“EEA”), United Kingdom (“UK”) or Switzerland, the controller of your personal information is NetApp Ireland Limited. In certain circumstances, for example, where you interact or engage with a European NetApp affiliate from this list, then that EU affiliate will be the controller of your personal information. If you are based outside the EEA, UK or Switzerland, the primary entity responsible for your personal information is NetApp, Inc.

If you are a job candidate applying for a role within NetApp, then our Candidate Privacy Policy is applicable to you.

NetApp is a data infrastructure company that provides unified data storage, integrated data services, and cloud operations solutions to enterprise customers (NetApp’s “Products and Services”). In the provision of these Products and Services, NetApp is a service provider. NetApp therefore acts as a ‘data processor’ or ‘sub-processor’ when processing personal data in order to provide its Products and Services. Where NetApp acts as a processor or sub-processor, NetApp will process customer personal information in accordance with NetApp’s Customer Data Processing Addendum or the applicable agreement in place between the parties designating the appropriate privacy and data protection safeguards.

Where our Products or Services are made available to you through an organization (eg, your employer), that organization may be the administrator of the Services and responsible for the accounts, website or systems over which it has control. In such circumstances, the privacy policy of NetApp’s customer or their customer in their capacity as a controller will apply to the processing of such personal information and you should direct privacy related queries or privacy rights requests to the data controller of your personal information.

In the course of your interaction or engagement with NetApp, NetApp may collect information about you. We refer to such information as “personal information” where the information relates (directly or indirectly) to an identified or identifiable living person. This includes information like your name, contact details, or device information. We usually collect personal information directly from you, but sometimes we will collect it automatically when you interact with our website, network or systems. We may collect the following categories of personal information:

• Contact Details: this includes information like your name, position, company, email address, postal address, and telephone number.
• Individual Identifiers: this includes information like your login alias and credentials, username, email address, or other information you provide to us that identifies you or verifies your identity.
• Customer Records: this includes information like your company name, job title, position, account number, customer identifier, or other information that relates to you in your capacity as an employee or representative of a NetApp customer.
• Partner/Supplier Records: this includes information like your company name, job title, position, account number, partner or supplier identifier, or other information that relates to you in your capacity as an employee or representative of a NetApp vendor, partner or supplier.
• Commercial Information: this includes account information, records of products or services purchased, obtained or considered, or other purchasing or usage histories or tendencies of the customer, payment card data, financial account information and other information necessary to collect and process payment for products and services ordered by the customer.
• Support Information: this includes information provided to NetApp by or for a customer for the purpose of providing technical support pertaining to the Product or Service and/or maintaining a customer’s Product or Service (such as basic device data or diagnostic information relating to support tickets). NetApp will typically process this information in its capacity as a data processor or service provider to its corporate customers, but may in limited circumstances process such personal information in a controller capacity.
• Audio or visual information: this includes information that is captured on audio or video recording, such as if a telephone or video call is recorded, CCTV footage at our physical office locations or information such as photos, live-streams or webcasts from events.
• Marketing Information: this includes information relating to existing or potential customers or marketing leads, such as consent preferences with respect to marketing communications, mailing lists, Products and Services in which they may be interested, your interaction or engagement with our marketing campaigns, events or webinars or related information from which such marketing interests or preferences may be inferred.
• Other Information: this means information that you may voluntarily provide to us in the course of your interaction or engagement with NetApp.

• Communications and usage data: this includes utilization data (eg, information on the beginning, end and extent of each access, and information on the telecommunications services you accessed), device data such as type of Internet browser and operating system used, domain name of the website from which you came, marketing or device identifiers, analytics data such as the number of visits, average time spent on the site, pages viewed. This category includes customer usage preferences or other information about an individual’s anticipated or assumed actions or behaviors.
• Functional Data: this includes data that is generated by NetApp’s provision of its Products or Services (such as IP address or other device or meta data), and which informs NetApp in the development, deployment, operations, maintenance, and securing of the Product or Service.
• Electronic Network Information: this includes information like browser and device data, and internet or network activity information, such as activity on our websites and Services, data collected through cookies, pixel tags and other technologies, and other information that is generated through your use of the internet to access our websites. For more information on our use of cookies and similar technologies, please see the NetApp Cookie Policy.
• Geolocation Data: this includes general location such as city, state, or country, your coarse location derived from IP address, or in limited circumstances your precise location where this is shared with us (for example, if you have such geolocation data enabled and you use Facebook to “Check In” at a NetApp-run event).
• Other Information: this means information that you may automatically provide to us in the course of your interaction or engagement with NetApp.

• Market Research: NetApp collects personal information from third-party agencies and service providers for the purpose of market research, product research, advertising, and business development. This includes information you choose to make publicly available on social media platforms in a professional context, such as name, email address, job title, company name, area of expertise and professional interests.
• Event Information: NetApp collects information about attendees at events that NetApp organizes and events that are co-hosted with our partners. For example, for certain market development events organized with our partners, those partners may share information about event attendees for legal compliance purposes. Separately, attendees may consent to sharing their contact information for marketing or sales purposes.

You might provide us with your personal information in a number of ways:

1. Our Websites: NetApp collects personal information when you interact with our websites, including, but not limited to, the website or subdomains of www.netapp.com, (eg, our Support site, Communities site, and Training site) or any website owned and controlled by NetApp.
2. Marketing forms: NetApp collects personal information from you when you sign up to receive marketing communications from us.
3. Products and Services: NetApp collects personal information through your use of products and services (our “Products and Services”). This includes hardware, software (including software for mobile devices or “apps”), cloud data services, professional services, and support services.
4. Social Media: NetApp collects personal information through your use of our social media pages and apps, through email messages that link to this Privacy Policy, through your interactions with third-party social media (such as LinkedIn, Facebook, Instagram or X), and when you publicly post using NetApp-related hashtags (eg, in online forums or discussion groups). In this Policy we refer to the use of our website, Products and Services and our social media pages as the “NetApp Platform”.
5. Offline: when you interact in person with representatives from NetApp, such as at an event we host or participate in or when you place an order over the phone or contact customer service by phone, we may collect personal information about you.

In applicable jurisdictions, we rely on different legal bases to process personal information. For each legal basis below, we describe the purposes of our processing (why we process your personal information) and our processing operations (how we process your personal information to achieve each purpose). We also list the categories of your personal information that we process for each purpose.

We process personal information as necessary to conclude and perform our contract with you, such as end user, licensing or service terms. The categories of personal information used and why and how they are processed are set out below:

Where permitted under applicable law, we rely on our legitimate interests or the legitimate interests of a third party, where they are not outweighed by your interests or fundamental rights and freedoms. Where we rely on a legitimate interest, we have also explained this legitimate interest below.

We process personal information as described below when you have given us your consent to do so, which we may ask through in-product experiences, to enable particular features or to enable device-based settings. In applicable jurisdictions, you can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

NetApp uses third-party service providers to provide services on our behalf and we may share Personal Information with them to assist them in providing these services. These can include providers of services such as website hosting, cloud storage, data analysis, payment processing, order fulfilment, information technology and related infrastructure provision, cloud-based services, customer service, email delivery, auditing, and other services. We may share personal information with professional advisors such as accountants, auditors, lawyers, insurers, bankers, and other outside professional advisors in countries in which NetApp operates.

We also share Personal Information with channel partners or resellers if you inquire about our products or services typically fulfilled through channel partners or resellers. Depending on the circumstances, such partners or resellers may be a data controller of your personal information, where they determine the purposes and means of processing. In that case they are responsible for the protection of your personal information in respect of the processing activities that they carry out with your information.

Unless otherwise limited by the context in which it was collected, personal information collected by a NetApp entity can be disclosed to other NetApp affiliates within the NetApp group for the purposes described in this Privacy Policy.

If you use communities, blogs, or chat rooms on NetApp Services, you should be aware that any Personal Information you submit there can be read, collected, and used by other users of these forums, and could be used to send you unsolicited messages. You may also elect to disclose Personal Information through your social sharing activity.

The following chart details the categories of third parties with whom NetApp shares your personal information for the above-mentioned operational business purposes:

NetApp and our third-party partners, such as our advertising and analytics partners, may use cookies or other tracking technologies (eg, web beacons, device identifiers and pixels) to provide functionality on our websites and platforms and to recognize you across different Services and devices.

Contact information, individual identifiers, commercial information, electronic network information, geolocation data, and functional data may in certain circumstances be “shared” with third-party adverting networks for cross-context behavioral advertising purposes, including within the preceding 12 months. To opt-out of any such sharing, you can interact with the cookie banner on our websites and select “Do Not Share My personal information”. Similarly, you can select the “cookie settings” button on the footer of our websites to manage your cookie preferences. Please note that information about you, your devices, and your behavior collected through third-party cookies, pixels, tags, or other tracking technologies for purposes of cross-context behavioral advertising may be considered “sharing” personal information under certain US state laws. However, NetApp is not a data broker, and we do not sell personal information for monetary consideration.

For more information, please see the NetApp Cookie Policy, which includes information on how to control or opt-out of cookies and tracking technologies.

Depending on where you are located, you may have certain privacy rights. For example, personal Information may be accessed, corrected, or deleted depending on the context in which it was collected. For some of our Products and Services your personal information can be accessed, changed, or deleted directly through the features and functionality of those Products and Services. In the event, however, you cannot or if you would like to restrict the use of your Personal Information, object to the processing of your Personal information or request that we complete another applicable privacy right, you may contact us at dataprotection@netapp.com  or by one of the methods described in the Contact Us section below. We will respond to your request consistent with applicable law.

In your request, please make clear what Personal Information you would like to have changed or otherwise let us know what limitations you would like to put on our use of your Personal Information. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to respond to your request as soon as reasonably practicable.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you make a purchase, you may not be able to change or delete related personal information until after completing the purchase).

We may also exempt certain Personal Information from requests pursuant to applicable data protection laws or other laws and regulations.

You have the right to request access to, rectification of, or erasure of your personal information, or restriction of processing, or object to processing of your personal information, as well as the right to data portability. In each case, these rights are subject to restrictions as laid down by law. The following is a summary of your rights:

• The right of access enables you to receive a copy of the personal information we hold about you and information about how we process it.
• The right to rectification enables you to correct any inaccurate or incomplete personal information we hold about you.
• The right to erasure enables you to seek erasure of personal information we hold about you.
• The right to restrict processing enables you to ask us to halt the processing of your personal information in certain circumstances.
• The right of data portability enables you to request us to transmit personal information that you provided to us to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible. This right only applies to personal information which you have provided to NetApp (and not to data which is received By NetApp from third parties).
• The right to object enables you to object to us processing your personal information on the basis of our legitimate interests (or those of a third party) including processing for direct marketing purposes. We will cease processing your personal information, unless the processing is based on compelling legitimate grounds or is needed for the exercise or defence of legal claims that may be brought by or against us.
• You have the right not to be subject to solely automated decision making, including profiling, which produces a legal effect or other similarly significant effect on you. This right is subject to certain restrictions and safeguards, and does not apply where the decision is (a) necessary for entering into or performance of a contract with you or (b) authorised by EEA (including at EU or individual member state level), Swiss or UK law or (c) based on your explicit consent.
• Where we rely on consent, you have the right to withdraw that consent at any time by updating your consent preferences on our website or by notifying us. The lawfulness of this processing before you withdraw your consent will not be affected by such withdrawal.
• You have the right to lodge a complaint about our practices with respect to your personal information with the relevant supervisory authority of the European country where you reside, of your place of work or the place of an alleged infringement if you consider that the processing of your personal information infringes your privacy rights.

Our International Headquarters are located in Cork, Ireland and the applicable privacy regulator for Ireland is the Data Protection Commission, which can be contacted by email at: info@dataprotection.ie or by using the following online form. You can also find details of relevant supervisory authorities here if you are based in the EEA. If you are based in the UK, you can contact the Information Commissioner’s Office (ICO) here. You also have the right to seek a judicial remedy in respect of any complaints you may have.

While you may make a complaint in respect of our compliance with applicable data protection laws as outlined above, we request that you contact us in the first instance to give us the opportunity to address any concerns that you may have.

Pursuant to the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act (CPRA) (collectively, the “CCPA”), if you are a California resident, you have the right to make the following requests:

• Request to Know: You may request that we disclose to you:
  • The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;
  • The specific pieces of Personal Information we collected about you;
  • The categories of Personal information about you that we “shared” (as defined under the CCPA) and the categories of third parties with whom we “shared” such personal information;
  • The business or commercial purpose for collecting or “sharing” (if applicable) Personal Information about you; and
  • The categories of Personal Information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such Personal Information (if applicable).
• Request to Delete: you may request that we delete personal information we collected from you.
• Request to Correct: you may request that we correct inaccuracies in your Personal Information.
• Request to Opt Out of “Sharing”: you may request to opt out of any future “sharing” or your Personal Information for purposes of cross-context behavioral advertising.

To make a Request to Know, Correct or Delete, please contact us at dataprotection@netapp.com or through any of the other methods listed under the Contact Us section below. 

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request. We may need to request additional Personal Information from you, such as email address, state of residency, or mailing address, in order to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your Personal Information. 

We do not sell and have not sold Personal Information, including Sensitive Personal Information, within the preceding 12 months, as “sale” is defined in the CCPA. No services on the NetApp Platform are directed to individuals under the age of sixteen (16), and we do not knowingly collect personal information from individuals under sixteen (16). You have the right to be free from unlawful discrimination or retaliation for exercising your rights under the CCPA.

If you want to make a request as an authorized agent on behalf of a California resident, you may contact us using the methods noted above. As part of our verification process, we may request that you provide, as applicable:

• Proof of your registration with the California Secretary of State to conduct business in California;
• A power of attorney from the California resident pursuant to Probate Code sections 4121-4130;
• Written permission that the California resident has authorized you to make a request on the resident’s behalf. This permission must be signed (via physical or e-signature) by the California resident.

If you are making a Request to Know, Correct or Delete on behalf of a California resident and have not provided us with a power of attorney from the resident pursuant to Probate Code sections 4121-4130, we may also require the resident to: verify the resident’s own identity directly with us or directly confirm with us that the resident provided you permission to submit the request.

Privacy laws and regulations are constantly growing and evolving. Some US States have adopted and enacted privacy and data protection laws at a state level – for example Colorado, Connecticut, Montana, Oregon, Texas, Utah and Virginia, as well as some other US States. These States allow for similar rights as are provided to California residents under the CCPA (as amended). To the extent, that you are resident of a one of these US States, or a privacy law otherwise applies in respect of you, then NetApp will abide by any applicable obligations and enforce your privacy rights.

Similarly, privacy laws in countries around the world are constantly being enacted. For example, India’s DPDP Act, Brazil’s LGPD, China’s PIPL, Indonesia’s PDP law, and Japan’s Act on the Protection of Personal Information, to mention a few. Where your country or jurisdiction affords you privacy rights, then NetApp will respect those rights and respond to them accordingly to meet any applicable privacy obligations to you.

To make a privacy rights request applicable to you in your respective country or US State, please contact us at dataprotection@netapp.com or through any of the other methods listed under the Contact Us section below.

We will retain your Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the NetApp Platform to you for example, for as long as you have an account with us or keep using the NetApp Platform:
• Whether there is a legal obligation to which we are subject for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them: or
• Whether retention is required in light of a legal position or for legal or regulatory purposes, such as in regard to applicable statutes of limitations, litigation or regulatory investigations.

If you would like further information about our data retention or deletion practices, you may contact us at dataprotection@netapp.com or through any of the other methods listed under the Contact Us section below.

NetApp uses reasonable and appropriate technical and organizational security measures to protect Personal Information within our organization. Details of our security practices can be found in our Information Security Addendum. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us at dataprotection@netapp.com or notify your appropriate NetApp representative or point of contact.

The NetApp Platform may contain links to other websites or services. NetApp is not responsible for the privacy, information or other practices of third parties, including any third party operating any website or service to which the NetApp Platform links, or for the content of other websites. The inclusion of a link on the NetApp Platform does not imply endorsement by NetApp of the linked site or service.

Your Personal Information may be stored and processed in a country where we have offices or facilities or in which we engage service providers for the purposes described in this Privacy Policy. As NetApp is a global group of companies, by using the NetApp Platform you understand that your information may be transferred to countries outside of your country of residence, which may have data protection rules that are different from those of your country. For example, your Personal Information may be transferred to our headquarters in California, United Sates or to NetApp affiliates in Ireland, India, Australia, or Israel where such NetApp affiliates provide support functions and services to NetApp and its customers.

If you are located in the EEA, the UK or Switzerland, we will only transfer your personal information outside of those regions using an appropriate legal transfer mechanism, including:

• Adequacy Decisions: some non-EEA countries are recognized by the European Commission as providing an adequate level of data protection under Article 45 GDPR (or equivalent decisions under other laws). A list of jurisdictions for which the European Commission has issued an adequacy decision is available here.
• Standard contractual clauses: the European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses. We rely on standard contractual clauses to transfer personal information to certain affiliates and business partners in countries without an adequacy decision, such as India and Australia. We also make certain transfers to our US affiliates in reliance on standard contractual clauses. You may obtain a copy of these standard contractual clauses by contacting dataprotection@netapp.com.
• Derogations: in certain limited situations, we rely on derogations provided for under the applicable law to transfer personal information to a third country.

We do not collect and ask that you not send us or disclose, any sensitive personal information (eg, social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the NetApp Platform.

Where we maintain or use de-identified information, we will continue to maintain and use the de-identified information only in a de-identified fashion and will not attempt to re-identify the information.

NetApp may amend or update this Policy from time to time. If we make changes that are material, we will provide you with notice of such changes as appropriate. We will post changes to our Privacy Policy on our website and update the "Last Updated" date at the top of this Privacy Policy. Please check this page regularly to keep up to date.

If you have any questions or comments about this Privacy Policy, or would like to request information required to be disclosed under global privacy laws, please feel free to contact our Privacy Legal team. You can contact us at dataprotection@netapp.com or at the following addresses:

Please note that for certain offices, in compliance with local laws in that jurisdiction, we have appointed a data protection officer (DPO). The DPO for Germany can contacted at: kontakt@rmprivacy.de and the DPO for Singapore can be contacted at dataprotection@netapp.com