Gong AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States of America, Europe, Israel, and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We may redact from the data which we will make available to you, any personal data or confidential information related to others. In compliance with the EU-U.S. DPF, and the UK Extension of the EU-U.S. DPP and the Swiss-U.S. DPF Principles, we commit to resolve complaints about our collection or use of your Personal Information. EEA, UK and Swiss individuals with inquiries or complaints regarding our Data Privacy Framework compliance should submit inquiries to [email protected] . If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, Gong.io, Inc. has further committed to cooperate with EU Data Protection Authorities (DPAs), the UK Information Commissioner Office (UK ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) to independently address complaints that we have been unable to resolve. Please note that under certain conditions (as described under the DPF Principles that Gong.io Inc. adheres to), you can invoke a binding arbitration by delivering a notice to us via [email protected] . Please also note that Gong.io Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ To the extent applicable to you, you may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by emailing us. Please note that when you or an authorized agent ask us to exercise any of your rights under this policy or applicable law, we may need to ask you to provide us certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data related to others and to ask you to provide further information to better understand the nature and scope of data that you request to access. We will not fulfill any request unless you have provided sufficient information that enables us to reasonably verify that you are the individual about whom we collected the personal data. If your request relates to personal data that is processed on our Customer’s behalf, as their “data processor” or “service provider” (as further explained in Section 10 below), then the Customer exclusively determines how such data is processed, as well as if and how your request should be handled – so we advise that you submit your request directly to them. If such data is processed on behalf of one of our Customers, we will forward your request to such Customer for their further handling. Such additional information may be then retained by us for legal purposes (e.g., as proof of the identity of the person submitting the request, or proof of request fulfillment). ” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Gong.io Inc., our US subsidiary, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce and will be further liable in cases of onward transfers of your personal data to third parties (including our Service Providers).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Gong.io Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) regarding the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Gong.io Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) regarding the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern for personal data transferred under the DPF. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . For data transfers from the EEA, Switzerland or the UK to countries which are not considered to be offering an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the European Commission, FDPIC and UK Information Commissioner’s Office (ICO). You can obtain a copy of these clauses by contacting us as indicated in Section 11 below.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States of America, Europe, Israel, and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law. While privacy laws may vary between jurisdictions, Gong is committed to protect personal data in accordance with this Privacy Policy and customary industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred. Gong.io Ltd., our parent company, is headquartered in Israel, a jurisdiction which is considered by the European Commission, the Swiss Federal Data Protection and Information Commissioner (FDPIC), and the UK Secretary of State to be offering an adequate level of protection for the personal data of residents of the European Economic Area (“EEA”), Switzerland and the UK, respectively. We transfer personal data from the EEA, Switzerland and the UK to Israel on this basis. Gong.io Inc., our US subsidiary, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce and will be further liable in cases of onward transfers of your personal data to third parties (including our Service Providers). ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Accordingly, Gong processes Customer Data strictly in accordance with our Customer’s reasonable instructions and as further stipulated in our Data Processing Addendum and other commercial agreements with such Customer. Our Customers are solely responsible for determining whether and how they wish to use our Platform, and for ensuring that all individuals using the Platform on the Customer’s behalf or at their request, as well as all individuals whose personal data may be included in Customer Data processed through the Platform, have been provided with adequate notice and given informed consent to the processing of their personal data, where such consent is necessary or advised, and that all legal requirements applicable to the collection, recording, use or other processing of data through our Platform are fully met by the Customer, including specifically in the context of an employment relationship. Our Customers are also responsible for handling data subject rights requests under applicable law, by their Users and other individuals whose data they process through the Platform.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Individuals have rights concerning their personal data. Please contact us by e-mail at: [email protected] if you wish to exercise your privacy rights under any applicable law, including but not limited to the EU or UK General Data Protection Regulation (GDPR), the Brazilian Data Protection Act (LGPD), the CCPA, or the Swiss Federal Act on Data Protection (FADP). Such rights may include – to the extent applicable – the right to know/request access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Gong, or to restrict or object to such personal data processing (including the right to direct us not to sell or share your personal data to third parties now or in the future, as described below), or to port such personal data, and you have the right not to receive discriminatory treatment for exercising your privacy rights (each to the extent available to you under the laws which apply to you). If you are a GDPR-protected individual, you also have the right to lodge a complaint with the relevant supervisory authority in the EU or the UK, as applicable. If you are an LGPD-protected individual, you also have the rights to confirmation of existence of processing; to request review of decisions made solely based on automatic decisions that affect your interests; to lodge a complaint with the supervisory authority and with consumer protection authorities in Brazil. ” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “For data transfers from the EEA, Switzerland or the UK to countries which are not considered to be offering an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the European Commission, FDPIC and UK Information Commissioner’s Office (ICO). You can obtain a copy of these clauses by contacting us as indicated in Section 11 below.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Certain data protection laws and regulations, such as the EU GDPR, UK GDPR, the Brazilian Data Protection Act, and the CCPA, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business”), who determines the purposes and means of processing; and the “data processor” (or under the CCPA, “service provider”), who processes the data on behalf of the data controller (or business). Below we explain how these roles apply to our Services, to the extent that such laws and regulations apply. Gong is the “data controller” of Prospect Data. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Privacy Policy. In such instances, our Service Providers processing such data will assume the role of “data processor”. Gong is the “data processor” of Customer Data, which we process on behalf of our Customer (who is the “data controller” of such data); and our Service Providers who process such Customer Data on our behalf are the “sub-processors” of such data. Gong is both a “data controller” and “data processor” of User Data. Such data is processed by Gong for its own purposes (as described in Section 2 above), as an independent ‘controller’; whilst those certain portions of it which are included in Customer Data will be processed by us on our Customer’s behalf, as a ‘processor’. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ 9.4 Effect of Termination. Upon termination or expiration of this Agreement for any reason whatsoever, all rights granted to Customer under this Agreement will immediately cease to exist and Customer shall immediately stop using the Services. Upon request by Customer made within 30 days after the effective date of termination or expiration of this Agreement, Gong will make Customer Data, including recorded calls, available to Customer for export or download as provided in the Documentation. After such 30-day period, Gong will have no obligation to maintain or provide any Customer Data, and as provided in the Documentation will thereafter delete or destroy all copies of Customer Data in its systems or otherwise in its possession or control, unless legally prohibited.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal data for as long as we deem it as reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (i.e., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise following your discontinuance of use), all in accordance with our data retention policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements. If you have any questions about our data retention policy, please contact us by e-mail at [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ 9.1 Termination. Either party may terminate this Agreement if the other party materially breaches its obligations hereunder, which default is incapable of cure or which, being capable of cure, has not been cured within 30 days after receipt of written notice from the non-defaulting party. 9.2 Refund or Payment upon Termination. If this Agreement is terminated by Customer in accordance with Section 9.1 above, Gong will refund Customer any prepaid fees covering the remainder of the term of all Order Forms after the effective date of termination. If this Agreement is terminated by Gong in accordance with Section 9.1 above, Customer will pay any unpaid fees covering the remainder of the term of all Order Forms to the extent permitted by applicable law. In no event will termination relieve Customer of its obligation to pay any fees payable to Gong for the period prior to the effective date of termination. 9.3 Surviving Provisions. The sections titled “Evaluation Services,” “Fees and Payment,” “Proprietary Rights and Licenses,” “Confidentiality,” “Disclaimers,” “Indemnification,” “Limitation of Remedies and Damages,” “Refund or Payment upon Termination,” “Surviving Provisions,” and “General” will survive any termination or expiration of this Agreement, and the section titled “Protection of Customer Data” will survive any termination or expiration of this Agreement for so long as Gong retains possession of Customer Data. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If required by applicable law, you may consent to such sharing via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your personal data will be subject to the sponsors’ privacy statements. If you do not wish for your personal data to be shared, you may choose to not opt-in via event/webinar registration or elect to not have your badge scanned, or you can opt-out in accordance with Section 9 below; Business Customers : Our Customers have access to personal data we process on their behalf in our capacity to them as a “processor” or a “service provider.” Gong Visioneer Community : When you participate in Gong’s Visioneer Community, your profile information, posts, and interactions are visible to other community members. You can control certain privacy settings within the Gong Visioneer Community site, but any information you share in community spaces may be viewed by other Users and visitors. Legal Compliance : We may disclose or allow government and law enforcement officials access to your personal data, including personal data contained in CCTV footage, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In such instances, we may share relevant contact, business and usage details with the respective partner, to allow them to engage with those entities and individuals for such purposes. If you directly engage with any of our partners, please note that any aspect of that engagement which is not directly related to the Services and directed by Gong is beyond the scope of Gong’s Terms and Conditions and Privacy Policy, and may therefore be covered by the partner’s terms and privacy policy. Service Integrations : You may choose to use a third-party service to integrate with our Services, for example, to upload or retrieve personal data to or from the Services, or to enrich the data you have processed on either service or enhance your usage thereof (provided that such integration is supported by our Services). The provider of this integrated third-party service may receive certain relevant data about or from your account on the Services, or share certain relevant data from your account on the third-party provider’s service with our Services, depending on the nature and purpose of such integration. This could include your Customer Data and/or User Data. Note that we do not receive or store your passwords for any of these third-party services (but do typically require your API key to integrate with them). Event Sponsors : If you attend an event or webinar organized by us, or download or access an asset on our Sites related to such an event, webinar or other activity involving third-party sponsors or presenters, we may share your personal data with them. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may have disclosed identifiers and customer record information to event sponsors. Through participation in the Gong Visioneer Community, you may disclose identifiers and customer record information. We disclose Personal Information in pursuit of the business and commercial purposes described in Section 2 above. Mobile Information and SMS Compliance : Notwithstanding anything to the contrary in this Privacy Policy, no mobile information or personal data collected via our text messaging programs will be shared with third parties, partners, or affiliates for marketing or promotional purposes. All the above categories of data sharing exclude text messaging originator opt-in data and consent; this specific information will not be shared, sold, or rented to any third parties.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “You can also reach out to [email protected] . Please note that opting out of promotional communications will not affect your receipt of important service-related communications, such as account notifications, security alerts, or transactional messages. For SMS communications, your mobile phone number and your consent to receive SMS messages will not be shared, sold, or rented with third parties, affiliates, or partners for marketing or promotional purposes. Gong may share this information with service providers that support the delivery and operation of our SMS communications on our behalf.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information with third parties through cookies on our website may be considered a “sale” or “sharing” of personal information. We do so in pursuit of the business and commercial purposes described in Section 2 above. For the purposes of the CCPA, in the last 12 months we may have “sold” or “shared” Internet or other electronic network activity information, Geolocation data, Commercial information, and Inferences with our analytics and advertising Service Providers. Gong has not knowingly sold or shared the personal information of individuals under the age of 16. If you access our Sites, from California, you can opt out of all Cookies that may result in a “sale” and/or “sharing” of your personal information in the following ways: Click the “ Your Privacy Choices ” button (on our website’s footer), move the toggle switch next to “Share or Sale of Personal Information” to grey (disabled), then click the “Confirm my Choices” button. If you visit us from a different device or browser, or clear cookies, then you need to return to this screen to re-select your preferences. Set the Global Privacy Control (GPC) for each participating browser system that you use to opt out of the use of third-party Advertising or other relevant cookies (instructions on how to download and use GPC are available here ).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Legal Compliance : We may disclose or allow government and law enforcement officials access to your personal data, including personal data contained in CCTV footage, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We disclose personal data in the following ways: Service Providers : We engage selected third-party companies and individuals to perform services on our behalf or complementary to our own. Such service providers may include hosting and server co-location services, communications and content delivery networks (CDNs), data security services, on-site security services (e.g., CCTV), billing and payment processing services, fraud detection and prevention services, Gong Academy exam monitoring services, web and product analytics, e-mail distribution and monitoring services, session or activity recording services, remote access services, content transcription and analysis services, our website chat feature, performance measurement, data optimization and marketing services, social and advertising networks, content and data enrichment providers, event production and hosting services, e-mail, voicemails, support, enablement and customer relation management systems, and our legal, financial and compliance advisors (collectively, “ Service Providers ”). Our Service Providers may have access to personal information, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use the data as determined in our agreements with them. Partnerships : We engage selected business and channel partners, resellers, distributors and providers of professional services related to our Services, which allow us to explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences for our Customers, Users and Prospects. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use the web analytics tool Google Analytics. This tool helps us understand users’ behavior on our Services, including by tracking page content, and click/touch, movements, scrolls and keystroke activities. Further information about Google Analytics’ privacy practices is available at: www.google.com/policies/privacy/partners. Further information about your option to opt-out of this analytics service is available at: https://tools.google.com/dlpage/gaoptout. You can manage your cookie preferences (depending on your location and activities on our Services): Through the “Your Privacy Choices” link available on our website. By adjusting your browser settings to accept, block, or delete cookies. If you choose to opt-out of certain cookies, this will typically generate a new cookie which will preserve your choice and indicate it to our Services in your next visits so that the cookies you opted-out of will not be utilized. You can also manage your cookies preferences, and accept, remove or entirely block cookies, through your browser settings. Certain web browsers may transmit “Do Not Track” signals to websites with which the browser communicates. However, due to differences in how web browsers interpret this feature and send those signals, and lack of standardization, we currently do not respond to such “Do Not Track” signals. If you get a new device, install a new browser, or clear or change your existing cookies, you may need to opt out again, because the previous opt-outs may be reset.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “For the avoidance of doubt, Gong may share personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, share or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ “Beta Services” means Gong services, feature or functionality that may be made available to Customer to try at its option at no additional charge or which is clearly designated as pre-release, beta, limited release, developer preview, non-production, or by a similar description. From time to time, Gong may make Beta Services available to Customer at a nominal fee or no charge. Customer may choose to try such Beta Services in its sole discretion. Beta Services are intended for evaluation purposes and not for production use, are not supported, and may be subject to supplemental terms. Beta Services are not considered “Services” under this Agreement; however, all restrictions, Gong’s reservation of rights and Customer’s obligations concerning the Services, and use of any Gong services shall apply equally to Customer’s use of Beta Services. Unless otherwise stated or communicated to Customer, any Beta Services trial period will expire upon the date that a version of the Beta Services becomes generally available. Gong may discontinue any Beta Services at any time in Gong’s sole discretion and may never make them generally available. Gong will have no liability for any harm or damage arising out of or in connection with Beta Services.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.