Zoho Corp

Zoho Corp is a global software company that offers a suite of cloud-based applications for business productivity.

4.1/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes

0/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.

Score

Yes, by contacting someone

60%

Yes, using an automated mechanism

100%

N/A

The service doesn't collect any personal information.

100%

Citation

We hold the data in your account as long as you choose to use Zoho Services. Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months. The data deleted from active database will be deleted from backups after 3 months.

If you are from the European Economic Area and you believe that we store, use or process your information on behalf of one of our customers, please contact the customer if you would like to access, rectify, erase, restrict or object to processing, or export your personal data. We will extend our support to our customer in responding to your request within a reasonable timeframe.

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

We may be required by law to preserve or disclose your personal information and service data to comply with any applicable law, regulation, legal process or governmental request, including to meet national security requirements.

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

We may need to share your personal information and aggregated or de-identified information with third-party service providers that we engage, such as marketing and advertising partners, event organizers, web analytics providers and payment processors. These service providers are authorized to use your personal information only as necessary to provide these services to us.

Transparency

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Note that all companies operating in the EU are subject to Art. 33 of the GDPR, which requires companies to notify their data protection authority of a data breach within 72 hours of discovering it.

Score

Not necessarily

Yes, eventually

Users will be notified in case of a data breach but within an unspecified amount of time.

70%

Yes, within 72 hours

100%

N/A

The service collects so little personal data that notification would not be possible.

100%

Citation

However, you will continue to receive essential notices and emails such as account notification emails (password change, renewal reminders, etc.), security incident alerts, security and privacy update notifications, and essential transactional and payment related emails.

Notes

In the hopes that 'security incident alerts' are what they mean, the policy does not provide precise details regarding data breaches.

Is the policy's history made available? Only the date it was last modified

3/5

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Does the policy outline the service's general security practices? Yes, including independent audits

3/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

At Zoho, we take data security very seriously. That's why we have gotten certified for industry standards mentioned here. We have taken steps to implement appropriate administrative, technical & physical safeguards to prevent unauthorized access, use, modification, disclosure or destruction of the information you entrust to us.

Notes

A copy of a security whitepaper is linked in the policy and viewable at https://www.zoho.com/security.html

A copy of compliance certifications, including independent audits, is linked in the policy and viewable at https://www.zoho.com/compliance.html

Collection

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

To communicate with you (such as through email) about products that you have downloaded and services that you have signed up for, changes to this Privacy Policy, changes to the Terms of Service, or important notices

To keep you posted on new products and services, upcoming events, offers, promotions and other information that we think will be of interest to you

To ask you to participate in surveys, or to solicit feedback on our products and services

To set up and maintain your account, and to do all other things required for providing our services, such as enabling collaboration, providing website and mail hosting, and backing up and restoring your data

To understand how users use our products and services, to monitor and prevent problems, and to improve our products and services

To provide customer support, and to analyze and improve our interactions with customers

To detect and prevent fraudulent transactions and other illegal activities, to report spam, and to protect the rights and interests of Zoho, Zoho’s users, third parties and the public

To update, expand and analyze our records, identify new customers, and provide products and services that may be of interest to you

To analyze trends, administer our websites, and track visitor navigations on our websites to understand what visitors are looking for and to better help them

To monitor and improve marketing campaigns and make suggestions relevant to the user

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Notes

Information You Provide: Account Signup: Name, contact info (email, phone), company name, username, password (optional: photo, timezone, language), Event Registrations: Name, email, contact info, Payment Processing: Name, contact info, payment details (e.g., last 4 digits of credit card), Testimonials: Name and personal details (if authorized), Support Interactions: Email, phone, and chat support communications.

Information Collected Automatically: Device and Usage Data: IP address, browser type, device info, operating system, usage patterns, and cookies, Application Logs and Analytics: Clicks, errors, performance data, devices used.

Information from Third Parties: Federated Logins (Google, LinkedIn): Name, email address, Referrals: Name, email, Resellers and Service Providers: Name, email, company name, Social Media: Public profile info (name, photo, posts).

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, but only for some non-critical data/uses

3/10

Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.

Score

On an opt-out basis, but only for some non-critical data/uses

30%

On an opt-out basis, for all non-critical data/uses

60%

On an opt-in basis

60%

N/A (no data used for non-critical purposes)

100%

Citation

You may opt out of receiving newsletters and other non-essential messages by using the ‘unsubscribe’ function included in all such messages. However, you will continue to receive essential notices and emails such as account notification emails (password change, renewal reminders, etc.), security incident alerts, security and privacy update notifications, and essential transactional and payment related emails.

You can disable browser cookies before visiting our websites. However, if you do so, you may not be able to use certain features of the websites properly.

You can choose not to provide optional profile information such as your photo. You can also delete or change your optional profile information.

If you choose to enable any third-party integrations, you may be allowing the third party to access your service data and personal information about you.

Does the service collect personal data from third parties? Yes

0/10

Last Updated

November 25, 2024

Sources

Source #1 ↗

Contributors

Anon-sec