UiPath procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The right not to be subject to a decision based solely on automated processing, including profiling” | Captured 2026-08-14Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the following rights in respect to your Personal data under the GDPR, which you may exercise at any time by submitting a request on our website here .” | Captured 2026-08-14Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Data Privacy Framework for data processed by UiPath Inc. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, UiPath commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact UiPath at dpo@uipath.com . In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, UiPath commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms with respect to personal data received or transferred pursuant to the Data Privacy Framework. UiPath commits to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to our organization and following the procedures and subject to conditions set forth in Annex I of Principles. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The right to file a complaint with the Data Protection Authority (ANSPDCP) and the right to address to the competent courts of law.” | Captured 2026-08-14Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “For any other questions regarding your rights please write to us at dpo@uipath.com . UiPath complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. UiPath has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. UiPath has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “In the context of an onward transfer, UiPath has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. UiPath shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage. The Federal Trade Commission has jurisdiction over UiPath’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We will store your Personal Data for a limited period, as necessary to achieve the purposes of the Personal Data processing, as described in this Policy, and in accordance with our legal, contractual obligations, legitimate interest and in accordance with our internal policies and procedures regarding personal data retention. This means that we retain different categories of data for different periods of time depending on the type of data, the category of data subject to whom the data relates, and the purposes for which we collected the data. We keep your personal data if you have a relationship with UiPath or are interested in our products or services. Once the retention period expires for a specific category of data, UiPath will delete, archive, anonymize or destroy it, in accordance with our internal policies and procedures, unless prohibited by the applicable law. We also delete your personal data whenever you withdraw your consent. You may request to have all your information deleted at any time by filling in this form . Contact dpo@uipath.com for more information about your privacy .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For the purposes described in this Policy we use the services of various contractors, digital service providers, such as Salesforce , Atlassian , Microsoft 365 , Marketo , Adobe , Discourse , Stripe , Google , Zoom , Gong , One Trust , AWS , Google , Ashby , HackerRank . Among others, these contractors process specific categories of Personal Data on our behalf to help us organize events, manage business information and contracts, market research, store data, analyze and organize data. We have contractual agreements with our contractors to ensure that your Personal Data is protected and used only as necessary to perform the contracted services. Some of our contractors are also controllers on their own, carrying out processing activities while using their services and products, which include online advertising technologies, search engines, cloud computing. Some of the contractors are third parties who are not intended to process the Personal Data but may have access to it upon fulfilling their tasks or interacting with us, such as technical maintenance companies, financial entities, or legal auditors. Whenever your personal data is transferred outside the EU or outside UK, to a third country, UiPath makes sure that there is a valid transfer mechanism in place, such as Standard Contractual Clauses or an International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers, to make sure that your personal data is protected.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ to comply with a legal requirement or to protect the rights and assets of UiPath or other entities or people, such as courts of law, or enforcement authorities;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As necessary to maintain an efficient selective channel system with the purpose of creating a retail environment where the commercialization of the Services is performed only by the UiPath authorized partners and distributors and customers’ demand is properly satisfied, we may share certain customers’ data (such as business contact details) with such UiPath authorized partners and distributors. We take appropriate measures, have contractual safeguards and we conduct internal assessment to ensure that the sharing of Personal Data is proportionate, transparent limited to the purpose and beneficial for you, that there are no privacy risks with all data privacy laws being observed during the processing. You may use the same form to exercise your right to opt-out of sharing personal information, if you are a resident of the state of California, as provided by the CCPA.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We share personal data with our affiliates as necessary to provide the Services or perform usual business activities. Personal data shared with our affiliates is granted GDPR level of protection. The list of UiPath affiliates can be found here .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you want to become a UiPath partner (e.g., business partner, Academic Alliance partner, Academy partner, etc.) we will process your Personal Data, such as full name, company, institution, job title, position or occupation, location, email, telephone number, industry, location, and other necessary information, in order to perform the underlying partner agreement and to create and manage your account in UiPath’s Partner Portal, as well as for providing access to our documentation. We use the services of third parties such as Tribble Inc. and Salesforce Inc. to develop our Partner Portal.” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As a global company, UiPath may share data with its affiliates, third-party processors, or business partners around the world. UiPath applies caution when contracting with processors or other controllers and performs the relevant activities and puts all the safeguards in place, as required to comply with the GDPR in relation to Personal Data transfers.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If you request our support, we will process the Personal Data needed for support, such as name, email address, country, company, job title and device ID, in accordance with our Support terms . We may also process voice data upon your consent, when support is offered via call center or remote. We process this data to perform the contract we have with you. We use Salesforce Inc. and Atlassian Corporation as main sub-processors for support purposes. We want to limit the usage of Personal Data to what is necessary for support purposes, so we rely on you to limit the disclosure and stick to sharing only technical data when raising support tickets. We may also use generative AI features for quality assurance and analytics in order to improve our processes, when you interact with us and send us support tickets or questions, based on our legitimate interest. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “To perform these activities, we use the services of SlapFive, Salesforce, Marketo, Gainsight and Bamko. We keep your data for as long as you are active in the program or until you opt-out. When you use UiPath’s cloud products, we will collect usage information such as performance logs, error logs, network logs, in order to fix errors, monitor the health of our software and improve our features and make them more user friendly. We may also use these data to identify breaches to our licensing terms. When you use UiPath website, and services such as Partner Portal, we may offer agentic chat support. We process conversations through our sub-processors (such as Cloudflare Inc. or Tribble Inc.) in order to provide you with the functionality and to improve future responses. Account Creation and Management. When you create an account with UiPath (Academy, Forum, Marketplace, UiBank, Community, Trial, Partner Portal, Certification, Automation Cloud Platform) to use the associated Services, including for the provisioning of licenses, we process your name, e-mail address, username, country, language, employment status, employer, job title, industry, area of interest, phone number, activity within the service, needed to grant you access to the Service and maintain the account. We process this data based on the terms & conditions of the Services (contract). Please keep in mind that due to the nature of some of our Services, such as Academy, Community Forum and UiPath Marketplace, your profile and your activity may need to be visible to other users. ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Our partners or sponsors may directly request information about you or may ask to scan your badge. Badge scanning is entirely optional, and you can at any time refuse to have your badge scanned. In all cases, if you allow other Event participants (including UiPath delegates), sponsors or partners to scan your badge, these participants may contact you about their products and services. We may be taking pictures and video recording our events (including events organized by third parties where we have booths or presentations), based on our legitimate interest to document our events and market their success. If you have any concerns regarding the photos/recordings of you from an event, you can always reach out to our photographers, organizing staff, or contact us at privacy@uipath.com . With your consent, we may process your personal information to post testimonials on our website or social networks. If you attend one of our events as a speaker, we will process your image and voice (photos, videos), name, title, company, information about your professional life and education, as well as your presentation slides (if the case). We will always ask for your consent before making this data public through our website, social media, or other channels. When registering for our events we may process your personal data through third parties we use as sub-processors such as Bizzabo.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In the context of an onward transfer, UiPath has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. UiPath shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage. The Federal Trade Commission has jurisdiction over UiPath’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may also provide personal data to third parties in the following situations: as lawfully requested by public authorities, auditors, or institutions competent to exercise inspections on UiPath, based on their legal obligations, such as data protection authorities or authorities for consumer protection, which may ask us to provide information;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “For any other questions regarding your rights please write to us at dpo@uipath.com . UiPath complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. UiPath has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. UiPath has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ If you opt-in, UiPath may also contact you via SMS related to your job application. We do not sell or share mobile or personal data with third parties, affiliates, or partners for marketing or promotional purposes. We only share data with third parties that act on our behalf when it is strictly necessary to deliver our service and only under binding agreements that ensure confidentiality and data protection. Under no circumstances will mobile data be shared or sold for advertising or promotional use . We keep candidate data for up to a year in order to send you relevant job opportunities or until you send us a deletion request. We delete or anonymize data in line with our internal data retention policies. If you opt-in to being recorded during the interview phase, we will only use the recording for recruitment purposes. Whether you opt in or not to being recorded will not impact your evaluation process. Recordings will be kept for up to 3 months. We only use trusted providers who are processing data on our behalf in the management of the recruitment process. See section 4. Personal Data Sharing and Disclosures .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ to third parties’ acquirers, as part of a change of control, merger or acquisition or similar procedures, if your Personal Data would be part of the transaction.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “When you try out our products, we will send you surveys in our legitimate interest or with your consent, to improve our products and provide you with a better user experience. We use the services of third-party sub-processors such as Jotform and SurveyMonkey to send you such surveys. We may use sub-contractors for data analysis, bound by data protection requirements. Privacy and security assessments . If you are an employee of our vendors, we process your name, e-mail address, company name as part of filling out the privacy and security questionnaires, based on your employer’s contract with UiPath. We use One Trust as sub-processor for managing such questionnaires. Data used for training purposes. When you use UiPath’s cloud products, the data used with the products may be used for product improvement and machine learning purposes, based on the contract with our customers, to provide them with improved functionalities. Please read the terms and conditions and product documentation. Please note that personal data and confidential data should not be used with the Community version of our products. We may use open-source data sets from legitimate sources to train or fine-tune our machine learning models. If we do so, we make sure that we use techniques and practices which minimize personal data processing is only incidental, making sure that it is only incidental. UiPath on-premises Services . UiPath does not have any access to Personal Data you use with the on-premises Services. ” | Captured 2026-08-14Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Data Privacy Framework for data processed by UiPath Inc. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, UiPath commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact UiPath at dpo@uipath.com . In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, UiPath commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms with respect to personal data received or transferred pursuant to the Data Privacy Framework. UiPath commits to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that an individual has invoked binding arbitration by delivering notice to our organization and following the procedures and subject to conditions set forth in Annex I of Principles. ” | Captured 2026-08-14Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.