BlackBerry Privacy Policy

This Privacy Policy (“Policy”) is effective starting January 1, 2024.

This Policy explains how BlackBerry Limited, its subsidiary companies and affiliates (“BlackBerry,” “we,” “our” or “us”) collect, use and share your personal data and the efforts we take to respect your privacy rights. Please refer to the section “Contact Us” for the contact details of the BlackBerry entity responsible for the Processing of your personal data as data controller.

This Policy also explains how our products, services and technologies use your personal data. It applies to our collection, use, transfer, storage and disclosure (“Process” or “Processing”) of your personal data when you visit our websites, register to attend an event, download and install any of our products, including consumer and mobile versions of our products, or utilize any of our online or offline services (collectively referred to as “BlackBerry Solutions”). This Policy further describes BlackBerry’s practices with respect to the Processing of your personal data.

Product privacy data sheets associated with a particular BlackBerry Solution provide additional information about BlackBerry’s Processing of your personal data in relation to that particular BlackBerry Solution (“Privacy Data Sheets”) and are available on the BlackBerry Privacy Resources web page.

This Policy covers the following topics:

1. Why we collect and use your personal data
2. What we collect and how we use your personal data
3. Legal bases BlackBerry relies upon to Process personal data
4. Sources of personal data
5. Sharing of your personal data
6. Information sharing to support Third-Party Offerings
7. International transfers of your personal data
8. How we protect your personal data
9. How long we store your personal data
10. Marketing communications from BlackBerry
11. Service-related communications from BlackBerry
12. Your personal data rights
13. Withdrawing your consent
14. Additional disclosures for California residents
15. Additional disclosures regarding Colorado, Connecticut, Utah and Virginia
16. Additional disclosures regarding Nevada
17. Additional disclosures regarding EEU/UK personal data
18. Contact us
19. Updates to our Privacy Policy

Related Links:

• BlackBerry Sales, Support and License Agreements
• BlackBerry Solutions Subprocessors
• BlackBerry Cookie Notice
• BlackBerry Product Privacy Data Sheets
• BlackBerry Privacy Resources
• BlackBerry Transparency Report
• BlackBerry Customer DPA

When visiting our websites or accessing BlackBerry account services

We automatically collect and aggregate information when you visit our websites, use accounts you create to access and obtain support or contact us. We use technologies, such as cookies, to enable functionality, measure website performance, and provide relevant information when you visit or return to our sites. We may also use this information to determine the effectiveness of content or the email messages you’ve subscribed to. For more information about the cookies we use, including how to manage cookies on your device and how to withdraw your consent to non-necessary cookies, please see the BlackBerry Cookie Notice.

This information helps our websites work correctly, provide information about BlackBerry Solutions and supports our efforts to understand our customers’ interests.

We collect the following types of information from you when you visit our websites and apps:

• Device and browser information: We collect information about the device and browser you use when visiting our websites, including information such as the Internet Protocol (IP) address of the device, your preferred language, the type of device you use, the device operating system and browser type.
• Geolocation: We may derive the approximate geographic location, such as country, region, state, or city based upon the IP address of the device used when visiting our website to analyze traffic and improve performance of our site.
• Browsing activity: We collect information about how you browse our websites, including the address of referring websites, the pages you visit, and the path you take through our websites.
• Social media features: Our websites allow you to share information on your social media platform of choice, such as Facebook, Twitter, and LinkedIn. These features are generally recognizable by their third-party logo and may collect your IP address, the page you are visiting on our site, and set a cookie to enable the feature to work properly when you use this functionality.

When requesting information or registering for an event or webinar

You may sign up to receive information about our company, BlackBerry Solutions, industry news and information, register to participate in our partner program, or register to attend an event or webinar. Based on your consent, we may send you electronic communications to keep you informed of changes to BlackBerry Solutions.

Your personal data will be accessed by authorized BlackBerry personnel to deliver the requested information and market to you in compliance with this Policy and applicable laws on direct marketing. We may also provide your personal data to third-party service providers to help us deliver the information you requested, support event activities, or provide updates about BlackBerry products and services. Third-party service providers are not permitted to use your information for any other purposes and are required to adhere to personal data protection laws.

The personal data we collect to deliver the information you requested, or register you for an event, may include your name, job title, company name, email address, country, phone number and recent web activity.

You can update your information, review your communication preferences, or stop receiving further communications from us by following the instructions contained within each communication we send you.

If you are registering for an event that is co-sponsored by another organization, you will be informed at the time of registration what data will be shared with that organization.

Personal data collected when registering with developer, partner or customer support web portals

Customers, partners and developers may register to access web portals to gain access to documentation, support content, download software, manage licenses, participate in a developer community, and submit customer requests. The personal data we collect may include your name, job title, company name, email address, mailing address, phone number and recent web activity. 

When using our products, software and services

As part of using our products, software and services we collect information, including personal data, that is necessary to perform those services, provide our products and software to you, manage licenses, communicate with customers and to improve and develop BlackBerry Solutions. Details on the personal data collected by specific BlackBerry Solutions are provided in the BlackBerry Privacy Resources web page.

When providing professional services to our clients, BlackBerry may collect personal data from our clients, users of our clients' networks and systems, and systems that connect to our clients' networks and systems. The collection and use of this personal data are limited to providing the professional service to the client. Authorized BlackBerry personnel will access personal data and we may transfer personal data to third-party service providers to help us provide these services.

Aggregated or anonymous data

BlackBerry may derive aggregated or anonymous data (i.e., data that is not associated with/linked to an identifiable individual or organization) from data collected through BlackBerry Solutions. BlackBerry may use aggregated/anonymous data for any lawful business purpose (including, without limitation, to develop and improve the BlackBerry Solutions and to create and distribute reports and other materials).

To find out more about the personal data collected by BlackBerry Solutions, see the BlackBerry Privacy Resources web page.

When purchasing consumer products from us

When purchasing consumer products from us and related offerings, we use PCI/DSS-compliant services provided by third-party service providers to process payments for your subscription. BlackBerry does not store or have access to your payment card information.

Information collected directly from you

Before using BlackBerry Solutions, you may be required to agree to an applicable supplemental notice that may contain additional information regarding BlackBerry’s Processing of your personal data.

If you provide BlackBerry with personal data about another person, you are responsible for ensuring that you have that individual’s consent to do so or that you are otherwise legally authorized to do so.

Information from third parties

We may receive information about you from our partners you’ve engaged with, as well as information about you or your company from third-party service providers to supplement the information you provided directly to us. This enables us to provide more relevant information about our company, products and services to you.

Use of third-party cookies

BlackBerry and its partners, including advertising networks, use cookies and other tracking technologies to manage our advertising delivered on other sites. We may display targeted advertisements to you while you are using our apps, visiting other company’s websites based on information we obtain from you, or from third parties. The use of cookies is discussed in the BlackBerry Cookie Notice.

When you download software or utilize services provided by third parties (a “Third-Party Offering”), personal data from your computer or device or other BlackBerry Solutions may be accessed by such third parties. When you purchase or use a Third-Party Offering, such as a product, service or software, a paid content subscription service or downloaded application, BlackBerry may share certain personal data with the third-party for purposes of providing you with the Third-Party offering and your personal data will then be subject to the third-party’s privacy policy. We encourage all our users to learn about the privacy practices of such third parties before agreeing to purchase or obtain their products, services or software.

BlackBerry uses contractual or other means to provide a comparable level of protection while the personal data is being Processed by our service providers. It is BlackBerry’s policy to enter into confidentiality obligations or employ other lawful data transfer mechanisms with any third-party that obtains confidential information including personal data from BlackBerry to ensure it is adequately protected.

We take commercially reasonable measures, including physical, administrative and technical safeguards, to protect your personal data from unauthorized access, use, alteration, destruction and disclosure. Despite our taking reasonable security precautions and processes, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we strive to protect all data we collect and Process, we cannot guarantee the security of any data you transmit to or from our sites, and you do so at your own risk. If you have reason to believe that your Personal Data may no longer be secure (for example, if you feel that the security of an account has been compromised), please notify us immediately.

BlackBerry products and services maintain certifications including ISO/IEC 27001:2013 and ISO/IEC 27018:2015. BlackBerry also undergoes multiple AICPA Service Organization Control (SOC 2 Type 2) audits each year for specific products and services. These reports are made available to our clients and partners under a suitable non-disclosure agreement. For more details about which certifications are applicable to the product or service you are using, please see our BlackBerry Certifications page. 

We retain your personal data for the period necessary to fulfill the purposes for which it was collected and for a reasonable period thereafter to comply with our legal obligations, and contractual and business operational requirements. With relation to personal data collected by BlackBerry Solutions, we retain information during the term of the agreement, based upon instructions provided by our customers, or for shorter periods of time as described in the applicable Product Privacy Data Sheet or other product or service documentation.

At the expiry of the applicable data retention periods, BlackBerry will take steps to have your personal data deleted, aggregated or made anonymous, unless further retention is required by applicable laws. Consistent with good business practice, BlackBerry continues to evolve our controls, schedules and practices for information and records retention and destruction which apply to your personal data.

Non-personal data, such as samples of potentially malicious software or anonymized data, may be retained indefinitely for the purpose of improving the performance of BlackBerry Solutions.

At BlackBerry we aim to provide the transparency you need to exercise your rights. Below you will find information on your personal data rights as well as how to make requests.

If you are a resident in the EEA/UK and covered by the (UK) GDPR, BlackBerry is the Data Controller of your personal data, except where BlackBerry Solutions have been deployed within an organization, such as your workplace or business, where BlackBerry would then act as a Data Processor under the GDPR.

If you are a resident of the State of California, your rights are addressed in this Policy under Your California privacy rights and BlackBerry’s practices.

Depending on the jurisdiction where you are located, you may also have the right to contact your local data protection supervisory authority to lodge a complaint against BlackBerry.

Accessing, rectifying and deleting your personal data

Upon written request, BlackBerry will inform you whether it holds personal data about you and provide you with your personal data within a reasonable timeframe and at minimal or no cost in accordance with applicable laws. If you identify an inaccuracy or incompleteness in your personal data, BlackBerry will amend your information and notify any third parties as required by applicable laws.

Upon written request, and to the extent authorized under applicable law, BlackBerry will also erase any personal data it holds about you using reasonably appropriate technical measures when:

• it is no longer necessary to Process your personal data;
• you withdraw your consent to Processing unless some other lawful basis exists for BlackBerry to continue to Process your personal data;
• you object to the Processing and no overriding legitimate grounds exist for BlackBerry to Process your personal data;
• the personal data has not been lawfully Processed by BlackBerry; or
• you have a legal obligation imposed under EU or EU member state law to which BlackBerry is subject.

You may exercise aforementioned rights at any time by notifying the Privacy Office at BlackBerry at privacyoffice@blackberry.com.

In certain situations, and depending on applicable laws, BlackBerry may not be able to provide you a copy of your personal data it holds about you if access may adversely affect the rights and freedoms of others. For example, BlackBerry may not provide access to personal data if doing so:

• would likely reveal personal data about a third-party;
• would reveal BlackBerry or third-party confidential information;
• could reasonably be expected to threaten the life or security of another individual;
• includes information that is protected by solicitor or attorney client privilege; or
• includes information that was Processed in relation to the investigation of a breach of an agreement or a contravention of a law.

In order to safeguard your personal data from unauthorized access, BlackBerry may ask that you provide sufficient information to identify yourself prior to providing access to your personal data.

Depending on the circumstances and subject to applicable laws, BlackBerry may deny processing your request or charge a reasonable fee if:

• we are unable to verify and authenticate your identity;
• it is unreasonably repetitive or automated; or
• otherwise excessive, for example if the request is malicious in intent and is being used to harass BlackBerry or its employees with no other purpose pursued than to cause disruption.

This “Additional disclosures for California residents” section is intended to describe our practices and your rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) (Civil Code Section 1798.100, et seq.) (collectively “California Law”). This section provides rights and other terms relating to your personal data that are in addition to those provided in this Policy (see above). These additional rights and other terms are only available to California residents about whom we collect personal data. This section takes precedence over the Policy with respect to your personal data for California residents if there is a conflict between the two. Any terms not defined in this section have the same meaning as defined in California Law. Additionally, any reference to personal data in this section has the same meaning as personal information as defined by California Law.

We do not sell, rent or lease your personal data we collect from you. We may share your personal data with third parties or allow them to collect personal data from our sites or services if those third parties are authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such personal data, or if you use BlackBerry sites or services to interact with third parties or direct us to disclose your personal data to third parties.

BlackBerry Solutions are not directed to individuals aged 16 and under or those not of the age of majority in your jurisdiction, and we request that these individuals, or others on their behalf, not provide us with their data. We do not knowingly sell or share the personal data of consumers under 16 years of age.

What Personal Data We Collect.

Over the past 12 months, we may have collected the following personal data from California residents:

• Identifiers or other elements of personal data under California Civil Code Section 1798.80 such as those described in “What we collect and how we use your personal data” above.
• Commercial information about products or services as described in “When using our products, software and services” above.
• Internet activity when you interact with BlackBerry’s website as described in “When visiting our websites or accessing BlackBerry account services” above and the BlackBerry Cookie Notice.
• Approximate geolocation data such as IP address as described in “When visiting our websites or accessing BlackBerry account services” and the BlackBerry Cookie Notice.
• Inferences drawn from any of the information identified above.

For information on how we collect your personal data and the uses of the personal data, please refer to the “What we collect and how we use your personal data” section above.

How We Disclose, Share or Sell Your Personal Data.

Disclosures. We may disclose your personal data with third parties for a business or commercial purpose. In the past 12 months, we have disclosed your personal data with the following categories of third parties for a business or commercial purpose:

• Internally. We may disclose your personal data to our affiliates, business partners, employees, and other parties who require such data to assist us with establishing, maintaining, and managing our business relationship with you.
• With Our Service Providers or Contractors. We may disclose your personal data to our service providers or contractors (including third-party hosting providers) that provide services on our behalf, such as for email marketing, data analytics, promotions, newsletters, notices, and other communications, or that assist us in monitoring, improving, and hosting the Services.
• Advertisers and Advertising Networks. Our website may include social media plug-ins (such as the Facebook like button), widgets (such as the “Share” button), or other tools made available by third parties, such as social media companies, that may result in data being collected or shared between us and the third parties for various purposes, including to select and serve personalized advertisements to you and others. These third parties may set and access their own cookies, web beacons, and embedded scripts on your device, and they may otherwise collect or have access to data about you, including unique personal identifiers such as an IP address, and they may share that data with us. Your interactions with these third parties are governed by the third parties’ privacy policies.
• In the Event of a Business Transaction. If we are exploring or go through a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy, securities offering, or sale of all or a portion of our assets, we may disclose your personal data to a party or parties in connection with exploring or concluding such transaction.
• For Legal Purposes. We will disclose your personal data when we think it is necessary to investigate or prevent actual or expected fraud, criminal activity, injury or damage to us or others; when otherwise required by law, regulation, subpoena, court order, warrant or similar legal process; or if necessary to assert or protect our rights or assets.
• With Your Consent or Authorization. To anyone for whom you have authorized disclosure of data in this Policy.
• Other. We may disclose your personal data for any other purpose disclosed by us when you provide the data.

Sales and Sharing. We do not sell or share the personal data we collect from you for direct, monetary profit or otherwise as defined under the CCPA. The above data is collected and used for the purposes disclosed in this Policy. In the 12 months immediately preceding the posting of this updated Privacy Policy, we have not sold or shared personal data of California residents.

Data Retention

We may retain all categories of your personal data (see above) for a period of time consistent with the original purpose of collection (see above) or as long as required to fulfill our legal obligations. We determine the appropriate retention period for personal data on the basis of the amount, nature, and sensitivity of the personal data being processed, the potential risk of harm from unauthorized use or disclosure of the personal data, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation).

After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will implement appropriate measures to prevent any further use of such data.

Your Rights and Choices under California Law

Below please find a description of key rights California residents have under California Law and an explanation of how to exercise those rights with us.

• Right to Know. If you are a California resident, you have the right to request that we disclose certain information to you about our collection and use of your personal data.
• Right to Delete. You have the right to request that we delete some or all of the personal data we have pertaining to you. Once we receive and confirm your verifiable consumer request, we will then delete (and direct our service providers to delete, if applicable) your personal data from our records, unless a lawful basis exists to retain it. We may deny your deletion request if we are unable to verify your identity or if we are not required to delete your personal data under the CCPA.
• Right to Correct Inaccurate Personal Data. You have the right to request that we correct any of the personal data that we maintain about you.
• Right to Opt Out of the Sale or Sharing of Personal Data. If BlackBerry sells or shares personal data about you to third parties, you may have the right to opt out and request that BlackBerry not sell or share your personal data.
• Right to Non-Discrimination. BlackBerry values the security and privacy of its customers and will not discriminate against you for exercising any of your California Law rights. If you exercise certain rights, understand that you may be unable to use or access certain features of the Services. Unless permitted by applicable law, we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (iii) provide you a different level or quality of goods or services; or (iv) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services. However, we will deny your request if (i) we cannot verify your identity or (ii) the disclosure creates a substantial, articulable, and unreasonable risk to the security of your personal data, your account with us, or the security of BlackBerry’s systems or infrastructure.

Exercising Your California Law Rights

You do not need to create an account with us to exercise your California Law privacy rights. To exercise the rights described above, please submit a consumer request to us by emailing: privacyoffice@blackberry.com.

To exercise your right to know, delete, or correct your personal data as described above, we need to verify your identity or authority to make the request and confirm the personal data relates to you. We will not provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. Making a verifiable consumer request does not require you to create an account with us. We use personal data provided in a verifiable consumer request solely to verify the requestor's identity or authority to make the request.

These requests may be made only by you, your parent, guardian (if you are under 18 years or age), conservator, a person to whom you have given power of attorney pursuant to California Probate Code sections 4000 to 4465, or an authorized agent. As permitted under California Law, we may request that an individual submitting a request on behalf of a consumer submit proof that they are an authorized agent of the subject consumer, as well as verify the consumer’s identity. To protect your personal data, we reserve the right to deny a request from an agent that does not submit adequate proof that you authorized them to act for you.

We are only required to respond to a verifiable consumer Right to Know request twice within a 12-month period. The verifiable consumer request must provide sufficient information to allow us to verify you (or an authorized agent) are the person about whom we collected personal data.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Once we have verified a request from a California resident, we will confirm receipt of the request within 10 days and explain how we will process the request. We will then respond to the request within 45 days. We may require an additional 45 days (for a total of 90 days) to process your request, but in those situations, we will provide you a response and explanation for the reason it will take more than 45 days to respond to the request. Our responses will include required information under California Law.

We value your feedback. If there are any questions regarding this Policy, or our collection and use of your personal data, you may contact us by email at privacyoffice@blackberry.com or by sending mail to one of the addresses below: