Qlik Product Privacy Notice

How Qlik manages privacy in its products

Qlik realizes that privacy is a significant priority for customers and users of our offerings. Qlik takes our privacy obligations seriously and adheres to data privacy laws, including by implementing both security-by-design and privacy-by-design practices in our products, as well as our development processes. We believe in communicating in an open, transparent manner about the ways in which user data personal data relating to an identifiable person (“User Personal Data”) is collected and used by our products and respecting customers’ and users’ choice and control over their User Personal Data.

1. Scope of this Notice

2. User Personal Data:

   1. Qlik Cloud

   2. Client-Managed Deployments

   3. Qlik applications for mobile devices

3. Uses of User Personal Data

4. Sharing of User Personal Data

5. Other privacy information

1. Scope of this Notice

   This Qlik Product Privacy Notice ("Notice") explains the collection and use by Qlik of User Personal Data. For privacy information relating to our other activities, such as our websites, please see the Qlik Privacy & Cookie Notice.
   
   Qlik also processes usage/telemetry data that does not contain User Personal Data, such as technical information (e.g., amount of data consumed for capacity-based pricing). For further information, see https://help.qlik.com/.
   
   Qlik may be a data processor (as defined under applicable privacy laws, such as the EU GDPR, CCPA, etc.) if we process personal data on a customer’s behalf, such as within Qlik Cloud or within our professional services offerings (e.g., customer support). For information on when Qlik may be a data processor on behalf of customers, please see our Privacy Trust page FAQs. Our processing of such personal data is governed not by this Notice but by the written agreement in place with your organization relating to such processing, such as the Qlik Data Processing Addendum.
   

2. User Personal Data

   Below we describe User Personal Data collected by our offerings. As Qlik is a B2B organization, User Personal Data details are B2B (e.g., work email, not personal email). User Personal Data may by collected directly from you (e.g., by registering as the administrative user, by contacting Qlik in-product) or by colleagues of yours in your organization (e.g., your administrative user adds you as a user of our offerings to grant you access to their Qlik deployment).
   
   Customers may choose to deploy our products (i) on-premise or on the customer's cloud provider of choice (in either case, "Client-Managed Deployment"), or (ii) by utilizing a cloud hosted solution provided and managed by us (“Qlik Cloud”). For confirmation of how you deployed our products, contact your organization's systems administrator/IT department.

   1. Qlik Cloud

      1. Name & email: Qlik processes tenant admin and account owner name and email to manage our relationship with your organization and deliver our services. We may also receive name and email if you contact Qlik while in-product, e.g., through a feedback form or if you contact Qlik Support while in-product. Name and email are also collected if you create a Qlik Account, as well as other details provided in the Qlik Account registration process (e.g., company name, country). For other users of our Qlik Cloud, Qlik processes the email of users to authenticate access and provide our offering to your organization; such user emails are managed by the customer (e.g., if a user is removed by the customer admin, their email address is deleted in our product).

      2. IP address: Like all cloud providers, we process IP address. Typically, we cannot identify individuals from IP address.

      3. IP Address - Qlik Anonymous Access: Qlik Anonymous Access enables customers to embed Qlik Analytics applications directly on their website(s) for their web visitors to interact with. Though Qlik cannot personally identify those web users, Qlik processes IP addresses of such web users for information security purposes (e.g., to protect the service from malicious attacks), to ensure compliance with export controls laws and to manage the service generally (e.g., quantify traffic). Such IP address data is typically deleted within 30 days. As Qlik does not have a direct relationship or interaction with such web users, customers are responsible for presenting (e.g., in their own privacy notice) the information in this paragraph to such users (e.g., by hyperlinking to this Notice).

   2. Client-Managed Deployments

      1. QlikView & Qlik Sense:

         1. License information: To activate the product and to regularly calculate license consumption, customers may use either License Enabler File (LEF) or Signed License Key (SLK) methods.

            • LEF: This contains User Personal Data (username) of the admin and the IP address of the system where the software is deployed. More information on the LEF process can be found here.

            • SLK: This contains the User Personal Data (name, email address) of the admin and users, as well as the IP address of the system where the software is deployed. More information on the SLK process can be found here.

         2. Usage information: Qlik uses Qlikmetrics for analytics purposes so we may better understand the use of our products so that we may optimize, support and improve our offerings. Customers may opt out of Qlikmetrics. The User Personal Data collected by Qlikmetrics is IP address only and we are unable to identify individual persons from this.

      2. Talend products:

         1. License information: Talend products use the Talend Administrator Centre ("TAC") to collect and send to Qlik license information to activate the product and quantify usage. This contains the User Personal Data (name, email address and mac address if present). More information on the TAC process can be found here.

         2. Usage information: Talend Usage Data Collector collects usage information for analytics purposes so we may better understand the use of our products so that we may optimize, support and improve our offerings. The User Personal Data present are user emails and mac address (if present). Customers can opt out of Talend Usage Data Collector. More information on Talend Usage Data Collector can be found here.

   3. Qlik Mobile Applications

      Our mobile applications available through device stores (collectively, "Qlik Mobile App(s)") may collect and send to Qlik analytics data about the usage of features within Qlik Mobile Apps. Users can deactivate this analytics data collection in the Qlik Mobile App settings. Qlik collects this analytics data so that Qlik can optimize, improve and promote its products. This analytics data may include a user ID, which may contain a user’s name.

3. Uses of Personal Data:

   We process User Personal Data to:

   1. Deliver and operate our offerings (e.g., user authentication, client-managed license deployments);

   2. Monitor license consumption and data consumption (e.g., where our offerings use data consumption-based pricing);

   3. Provide technical support;

   4. Assist customers (via our Customer Success and other departments) to improve their use and adoption of our offerings, e.g., by making tailored suggestions and delivering insights to customers/users based on their interaction with our offerings. We may also use this data to enhance conversations with existing customers by providing our account teams with greater context and background regarding how customers deploy and use our offerings;

   5. Contact you if you complete a feedback form in-product and ask to be contacted by us;

   6. Improve our offerings by analyzing usage trends;

   7. Ensure security of our offerings, for example to monitor for suspicious activity and protect our offerings and the data they process; and

   8. Ensure compliance of our offerings with our legal obligations (e.g., regarding restricted/denied party lists).
      
      While certain uses of User Personal Data may require it to be individualized (e.g., authentication), we typically remove personal data identifiers where the data is used for other purposes which do not require the data to be personalized (e.g., analyzing usage trends).
      

4. Sharing of User Personal Data

   For all deployment methods, we may share with your organization/employer your User Personal Data relating to our offerings to assist your organization in managing such offerings (e.g. understanding consumption, increase adoption, regulate access). We may also share such information with our affiliates to perform our services and/or operate our products, as well as with third party service providers to operate our business. Finally, where your organization has purchased our offerings through one of our partners, we may share such data with that relevant partner to manage our relationships with your organization, the relevant partner, and to aid the direct relationship between your organization and the relevant partner.

5. Other privacy information

   1. Data Controller: Qlik is typically the data controller (as defined under privacy laws, such as the EU GDPR) of User Personal Data because Qlik decides the means and purposes of processing. The relevant data controller will be the Qlik entity with which your organization contracts. For further information, see the Qlik Customer Agreement, Table 1.

   2. Privacy-By-Design and Privacy-By-Default: We have implemented Privacy-By-Design and Privacy-By-Default taking privacy concerns into account as a native component of our product development process. One example is how Qlik Sense manages access to apps created within the platform: by default, only the person who created the app can access it. Access must be explicitly granted by the creator or an administrator before other users can view or use the app.

   3. Lawful bases for processing: We will only collect User Personal Data where it is necessary to perform the relevant processing activity and will ensure it is protected by suitable access, retention and other controls. The lawful bases under which we process User Personal Data are our legitimate interests to carry out our contracts (e.g., deliver and administer our offerings) and other legitimate business interests (e.g., to improve our offerings, to protect our legal or proprietary rights) and/or to comply with legal obligations (e.g., ensure security of and lawful use of our offerings).

   4. Security: Access to User Personal Data is least-privilege, meaning only those Qlik personnel who need access to it for their roles are permitted to access it. Further information regarding our security program can be found on our Security Trust page.

   5. International Data Transfers: Qlik has in place measures to ensure the lawful transfer of personal data. These include, for example, data protection agreements supplemented, where necessary, by additional protections such as the UK/EU Standard Contractual Clauses to ensure the lawful transfer of personal data by Qlik within our international group of companies and with relevant third parties (e.g., service providers). The U.S. operating affiliates of the Qlik group comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. These affiliates have certified to the U.S. Department of Commerce that they adhere to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. These affiliates have certified to the U.S. Department of Commerce that they adhere to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. These affiliates commit to subject to the DPF Principles all personal data received from the EU, UK, and Switzerland in reliance on the relevant DPF. If there is any conflict between the terms in this privacy notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/. To view Qlik’s Data Privacy Framework Policy, please visit: https://www.qlik.com/us/legal/legal-policies. For our measures in relation to personal data for which Qlik is a data processor (e.g., subprocessors), please see our customer Data Processing Addendum.

   6. Data Retention: Qlik retains User Personal Data only for as long as necessary to fulfil the reason we collected it. For example, User Personal Data of licence users may be deleted by the customer by removing a user’s entitlement. After expiration of the customer’s Qlik Cloud license, Qlik deletes the customer’s tenant, including User Personal Data relating to licence users 210 days after expiration; for further information, see here.

   7. Further Privacy Information: For further information relating to security, the sharing of any personal data, how we protect personal data, as well as data subject rights, please see our Qlik Privacy & Cookie Notice and Privacy Trust resources.

   8. Contact: Users may contact Qlik for access or deletion requests via our Privacy Request Form. Qlik’s Data Protection Officer and privacy team may be contacted at privacy@qlik.com or through the contact details provided in our Qlik Privacy & Cookie Notice.

Links to further resources:

• Qlik Help

• Qlik Legal Agreements (incl. Data Processing Addendum)

• Qlik Community

• Qlik Trust and Security

• Qlik Trust and Privacy

• International Transfers/Schrems II FAQ

• Qlik Privacy & Cookie Notice

Legal Information:

The information in this Notice is accurate as of May 30^th, 2025. Qlik reserves the right to make changes from time-to-time to the privacy practices of its products and services and you are encouraged to check this Notice for future updates. This Notice may also be supplemented by further privacy disclosures made available at the time of collection/processing. This Notice is for information purposes only and does not form part of customer contractual terms.