SAS

SAS EU/UK Privacy Statement: Practical Overview

*Applies to residents of the EEA, Switzerland and the UK. Revised October 1, 2023.*

1. Data Collection and Use

Data collected

SAS may collect:

• Identity and contact data: name, address, telephone number and email.
• Professional information: professional interests, experience and interactions with SAS products.
• Business and marketing data: language, communication and marketing preferences.
• Transaction data: purchases, orders, contracts, billing, delivery and technical-support details.
• Technical and usage data: IP address, device and browser details, pages visited, session activity and interaction with emails.
• Security data: authentication and fraud-prevention information.
• Information from other sources: social media, public sources, trade shows, events, third parties and affiliated SAS systems.

Collection may occur through profiles, forms, cookies, pixels, mobile apps, surveys, customer support, sales activity, social-media interactions and automated analytics. SAS may combine online data with information obtained offline or from affiliates.

Main uses

SAS uses data to:

• Provide subscriptions, software, services, support and requested information.
• Manage customer, vendor and business relationships.
• Send news, product information, events, offers and marketing.
• Personalize websites, advertising and content through analytics and profiling.
• Operate forums and communication channels.
• Secure systems and detect fraud or prohibited activity.
• Improve or develop products and services, including through statistical analysis.
• Meet legal obligations and establish or defend legal claims.

The stated legal bases include contract performance, legal obligations, SAS’s legitimate interests and consent. Marketing consent may be required in some circumstances, and marketing emails generally include unsubscribe options.

2. User Rights

Subject to legal exceptions, users may request:

• Access to their personal data.
• Correction of inaccurate, incomplete or outdated data.
• Portability of data they provided, where legally required.
• Objection to certain processing, particularly processing based on legitimate interests.
• Deletion, although SAS may retain data for legal obligations, claims or other permitted purposes.
• Restriction of processing during certain disputes or requests.
• Withdrawal of consent at any time, without affecting earlier lawful processing.
• Marketing opt-out through unsubscribe links or SAS profile settings.

Requests are generally free, but SAS may refuse or charge for requests that are unfounded, excessive or repetitive. Identity verification may be required. SAS may reject requests made through automated or third-party tools unless directly validated by the individual.

Users may complain to a data-protection authority in their country of residence, workplace or where the alleged infringement occurred. Requests can be made through SAS’s Data Privacy Rights Form or at privacyrights@sas.com.

3. Third-Party Sharing and International Transfers

SAS states that it does not sell, rent or lease personal data. It may nevertheless share data with:

• SAS subsidiaries, affiliates and business units.
• Vendors, subcontractors, processors and business partners.
• Buyers or transferees involved in a corporate sale or asset transfer.
• Other users where information is voluntarily posted in SAS communities.
• Government or law-enforcement authorities where considered necessary or appropriate.
• Parties needed to protect SAS’s rights, property, websites or security.

Data may be transferred to and processed in the United States and other countries outside Europe. SAS relies on Standard Contractual Clauses and other lawful transfer mechanisms. Users may request copies of applicable clauses, subject to redactions.

4. AI/ML Training

The Statement does not expressly say that personal data is or is not used to train artificial-intelligence or machine-learning models. It permits statistical analysis, profiling, product development, service improvement and automated inferences about product interests. These provisions could potentially support analytics or model development, but they do not clearly define whether customer data is used for generative-AI or ML training, whether data is anonymized first, or whether users can opt out.

Users seeking clarity should request a specific explanation from SAS, particularly regarding data used in support interactions, websites, analytics and product-improvement programs.

5. Key User Responsibilities and Restrictions

Users should:

• Provide accurate information where necessary to receive services or exercise rights.
• Avoid posting information in public SAS forums unless comfortable sharing it with other participants.
• Review separate notices and agreements governing Hosted Managed Services, technical support, consulting and CI 360 data; this Statement does not govern those categories.
• Review the privacy policies of linked third-party websites. SAS does not control or accept responsibility for them.
• Understand that some information may be necessary to provide a product or respond to a request.

6. Liability and Disputes

The Statement describes security measures but does not guarantee absolute security or specify a particular compensation regime, liability cap, governing law or court/arbitration process. It does not appear to create a detailed contractual dispute-resolution procedure.

Privacy complaints may be submitted to SAS or a supervisory authority. Separate SAS contracts may contain additional liability, governing-law and dispute terms.

7. Changes to the Statement

SAS says it will post updates on the relevant website and change the revision date. Continued website use after changes are posted is stated to mean acceptance of the changes. The policy does not promise individualized notice by email, so users should periodically review it.

SAS Terms and Conditions: User Overview

*This summary is based only on the supplied Terms and Conditions, revised October 18, 2018. It is not a substitute for legal advice. The separate SAS Privacy Statement is important, especially for privacy rights and broader data practices.*

1. Data Collection & Usage

The Terms do not provide a comprehensive privacy notice. They mainly identify the following data practices:

• Account and registration data: Users must provide and maintain current, accurate, and complete information when registering for an account.
• Account and security information: SAS may process information associated with login credentials and accounts. Users are responsible for all activity conducted through their accounts.
• Customer information: Certain password-protected services may display customer information, such as names and product information. By registering, users consent to this display and accept the risk of unauthorized access.
• Private Area data and cookies: For private web areas, SAS may collect and process personal data needed to administer security. It may also store and retrieve session information through cookies to support login/logout and prevent unauthorized access.
• Community profiles and postings: Users may voluntarily include personal information in community profiles or postings. The Terms warn users not to disclose sensitive information such as Social Security numbers or credit card numbers.

The Terms state that Private Area data may be retained until the relevant purpose ends or under SAS’s applicable retention policy. For other processing, users must consult the separate SAS Privacy Statement.

2. User Rights

The document does not clearly describe rights to:

• Access, correct, delete, or export personal data;
• Withdraw consent;
• Object to processing or restrict processing; or
• File privacy complaints.

Those rights, if available, are governed by the SAS Privacy Statement and applicable law—not this document.

Users can generally control who sees some profile information through privacy settings. However, even information marked private may be accessible to SAS and third parties depending on their access level.

3. Third-Party Sharing

The Terms permit or contemplate access by:

• SAS affiliates and service providers, including third-party software used to create or administer Private Areas;
• Other community users, because postings are generally intended to be shared;
• Third parties with access to community profiles, depending on privacy settings and access permissions; and
• Courts or government authorities, potentially as required by applicable law, although this document does not detail disclosure procedures.

Community content is expressly treated as generally non-confidential and not governed by the SAS Privacy Statement unless a written agreement says otherwise.

4. AI/ML Training

The Terms contain no express statement about whether user data, postings, profile information, or uploaded content is used to train artificial intelligence or machine-learning models.

However, community postings and unsolicited submissions receive extremely broad licenses allowing SAS to use, copy, modify, publish, distribute, and create derivative works from them worldwide, perpetually, irrevocably, and without royalties. This could permit broad use of content, but it does not specifically confirm AI training. Users should seek clarification from SAS before posting confidential, proprietary, personal, or commercially sensitive material.

5. Key User Obligations and Restrictions

Users must:

• Keep account credentials confidential and promptly report security breaches;
• Avoid using another person’s account;
• Ensure postings are lawful, accurate, non-defamatory, non-infringing, and free of malware;
• Avoid disclosing confidential information, third-party personal data, or regulated information;
• Follow U.S. export controls, sanctions, and restrictions on encryption, weapons-related technology, and controlled technical data;
• Avoid harvesting user information or sending unsolicited email;
• Use website materials only for permitted personal, educational, or other non-commercial purposes unless authorized;
• Not copy, modify, frame, mirror, redistribute, or use SAS materials to develop competing products.

A particularly serious provision imposes $75,000 in liquidated damages per instance of certain prohibited use, in addition to possible copyright damages. SAS may terminate access at its sole discretion.

6. Liability and Disputes

• Website content, software, products, and services are provided “as is,” with broad warranty disclaimers.
• SAS disclaims liability for direct, indirect, consequential, special, incidental, lost-profit, lost-revenue, lost-data, and loss-of-use damages, subject to any separate agreement.
• Users must indemnify SAS and its affiliates for claims arising from their use, submitted content, or violations of the Terms or others’ rights.
• Disputes are governed by U.S. federal law or North Carolina law and must generally be brought in state or federal courts in Raleigh or Wake County, North Carolina.
• SAS may seek injunctions and other equitable relief for confidentiality or PartnerNet breaches.

7. Changes to the Terms

SAS may change the website, services, products, or Terms at any time without further notice. Continued use after changes constitutes acceptance. Users should periodically review the Terms; the document identifies October 18, 2018 as its revision date.