Gong

Downstream

Who's behind Gong, as listed in its own subprocessor documents. No subprocessors identified · coverage incomplete: no subprocessor document is on file; the names below come from other documents, if any.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. no training clause matched

Documents read

• privacy policy https://www.gong.io/privacy-policy/HTTP 200 · 2026-10-17
• dpa https://www.gong.io/legal/data-processing-addendumHTTP 200 · 2026-10-17

Document changes

• medium 2026-10-17 · dpa +1 / −2 lines
  show diff

  + Gong is a Leader again in the 2026 Gartner® Magic Quadrant™ for Revenue Action Orchestration.

  − See what’s next in Revenue AI and get a preview of the latest Gong innovations.

  − Watch on demand
• medium 2026-10-17 · privacy policy +1 / −2 lines
  show diff

  + Gong is a Leader again in the 2026 Gartner® Magic Quadrant™ for Revenue Action Orchestration.

  − See what’s next in Revenue AI and get a preview of the latest Gong innovations.

  − Watch on demand
• low 2026-10-13 · dpa +0 / −1 lines
  show diff

  − SearchSign in
• low 2026-10-13 · privacy policy +0 / −1 lines
  show diff

  − SearchSign in
• high 2026-10-02 · dpa +2 / −2 lines
  show diff

  + See what’s next in Revenue AI and get a preview of the latest Gong innovations.

  + Watch on demand

  − Announced at Celebrate '26: New innovations coming to Gong Revenue AI with Mission Callisto

  − All systems go
• high 2026-10-02 · privacy policy +2 / −2 lines
  show diff

  + See what’s next in Revenue AI and get a preview of the latest Gong innovations.

  + Watch on demand

  − Announced at Celebrate '26: New innovations coming to Gong Revenue AI with Mission Callisto

  − All systems go
• high 2026-10-01 · dpa +2 / −2 lines
  show diff

  + Announced at Celebrate '26: New innovations coming to Gong Revenue AI with Mission Callisto

  + All systems go

  − Join us virtually for the Celebrate '26 opening keynote on Sept 30 — hear from leaders at Anthropic, AT&T, Cisco, and Gong.

  − Save your seat
• high 2026-10-01 · privacy policy +2 / −2 lines
  show diff

  + Announced at Celebrate '26: New innovations coming to Gong Revenue AI with Mission Callisto

  + All systems go

  − Join us virtually for the Celebrate '26 opening keynote on Sept 30 — hear from leaders at Anthropic, AT&T, Cisco, and Gong.

  − Save your seat
• high 2026-09-30 · dpa +98 / −60 lines
  show diff

  + LAST UPDATED: September 2026

  + This Data Processing Addendum (“DPA”) forms part of the Gong Terms and Conditions, or other agreement governing the use of Gong’s services (“Agreement”) entered by and between you (“you”, “your”, “Customer”), and Gong.io Inc. (“Gong”). This DPA sets out the terms that apply to the Processing of Personal Data (as defined below).

  + 1.7. “Customer Personal Data” means Personal Data, within Customer Data Processed by Gong on behalf of Customer under the Agreement, or such equivalent concept as defined under applicable Data Protection Laws

  + 1.8. “Data Protection Laws” means all applicable and binding privacy and data protection laws and regulations in the locations where Gong operates the Services, including the GDPR, UK GDPR, and the CCPA.

  + 1.9. “Data Subject” means an identified or identifiable natural person to whom the Personal Data relates.

  + 1.10. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

  + 1.11. “Information Security Standards” means the security documentation applicable to the Services purchased by Customer, as updated from time to time, as made reasonably available to Customer by Gong.

  + 1.12. "Personal Data" or “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with a particular Data Subject or Consumer (as defined in the CCPA, to the extent applicable).

  + 1.13. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

  + 1.14. “Personnel” means persons authorized by Gong to Process Customer Personal Data.

  + 1.15. “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data pursuant to this DPA, whether or not by automatic means, such as collection, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure or destruction.

  + 1.16. “Processor” means the entity which Processes Personal Data on behalf of the Controller.

  + 1.17. “Sensitive Data” means Personal Data that is protected under a special legislation and requires unique treatment, such as “special categories of data”, “sensitive data” or other materially similar terms under applicable Data Protection Laws, which may include any of the following: (a) social security number, tax file number, passport number, driver’s license number, or similar identifier (or any portion thereof); (b) credit or debit card number; (c) financial, credit, genetic, biometric or health information; (d) information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences; and/or (e) account passwords in unhashed form.

  + 1.18. “Services” means the Gong Revenue Intelligence™ platform and products and services (and related Documentation) described on Customer’s ordering form(s).

  + 1.19. “Standard Contractual Clauses” means (a) in respect of transfers of Personal Data subject to the GDPR, the standard contractual clauses between controllers and processors, and between processors and processors (as applicable), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including all annexes thereto (“EU SCCs”); (b) in respect of transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses of 21 March 2022 (version B.1.0), as incorporated into the EU SCCs through Schedule 1 Part 2 hereto (“UK Addendum”); and (c) in respect of transfers subject to the Federal Act on Data Protection (FADP – as revised as of 25 September 2020), the terms set forth in Schedule 1 Part 3 hereto (“Switzerland Addendum”).

  + 1.20. “Sub-Processor” means any third party service provider engaged by Gong that Processes Customer Personal Data under the instruction or supervision of Gong.

  + 1.21. “UK GDPR” means the Data Protection Act 2018, as well as the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).

  + 2.1. Scope and Roles. Except as set forth under Schedule 2, this DPA applies when Customer Personal Data is Processed by Gong strictly on behalf of Customer, as part of Gong’s provision of the Services. In this context and for the purposes of the GDPR or any similar Data Protection Laws, Customer is the data Controller and Gong is the data Processor (or such other similar terms as defined under applicable Data Protection Laws); and for the purposes of the CCPA (to the extent applicable), Customer is the Business and Gong is the Service Provider.

  + 2.2. Subject Matter, Duration, Nature and Purpose of Processing. Gong Processes Customer Personal Data as part of providing Customer with the Services, pursuant to the specifications and for the duration under the Agreement.

  + 2.3. Type of Personal Data and Categories of Data Subjects. Customer and Authorized Users determine the identity of the persons which are part of the conversations and content analyzed by the Services, and the type and nature of any Customer Personal Data (if any) exchanged in such conversations or included in such content. Gong has no control over the identity of the Data Subjects whose Customer Personal Data is processed on behalf of Customer and over the types of Customer Personal Data Processed. (including as described in Schedule 2). The Services are not intended for the Processing of Sensitive Data. At Customer’s selection, the Services may also be used to capture voice identifiers relating to Authorized Users, for speaker identification and call cataloging purposes.

  + 2.4. Customer’s Obligations and Instructions. Customer shall, in its use of the Services, only submit or otherwise have Customer Personal Data Processed in accordance with the requirements of Data Protection Laws. Gong will only Process Customer Personal Data on behalf of and in accordance with Customer’s reasonable instructions. Customer instructs Gong to Process Customer Personal Data for the following purposes: (i) Processing to provide and ensure proper operation of the Services in accordance with the Agreement; (ii) Processing initiated or instructed by Authorized Users in their use of the Services; (iii) Processing to comply with other reasonable instructions provided by Customer where such instructions are consistent with the Agreement; (iv) sharing Customer Personal Data with, or receiving Customer Personal Data from, third parties in accordance with Customer’s instructions and/or pursuant to Customer’s use of the Services (e.g., integrations between the Services and any services provided by third parties, as configured by or on behalf of Customer); (v) rendering Customer Personal Data fully and irrevocably anonymous and non-personal, in accordance with applicable standards recognized by Data Protection Laws and guidance issued thereunder; and (vi) Processing as required under any applicable laws to which Gong is subject, and/or as required by a court of competent jurisdiction or other competent governmental or semi-governmental authority, provided that Gong shall inform Customer of the legal requirement before Processing, unless prohibited under such law or requirement. For the avoidance of doubt, Customer’s instructions for the Processing of Customer Personal Data shall comply with Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired Customer Personal Data. Where required by applicable data protection laws, Customer shall configure and utilize the consent management features of the Services, including dual-party consent functionality, to ensure lawful recording, processing, and use of audio or other communications. Without limitation, Customer will provide all necessary notices to relevant Data Subjects, including a description of the Services, and secure all necessary permissions and consents, or other applicable lawful grounds for Processing Customer Personal Data pursuant to this DPA and/or under Data Protection Laws, and shall indemnify, defend and hold harmless any claim, damages or fine against Gong arising from any failure to acquire or use the Customer Personal Data with legal consent or legitimate business purpose or in violation of any Data Protection Laws. Gong will inform Customer, if in Gong's opinion an instruction infringes any provision under any Data Protection Laws and will be under no obligation to follow such instruction, until the matter is resolved in good-faith between the parties.

  + To the extent that Gong cannot comply with an instruction from Customer, (i) Gong shall promptly inform Customer, providing relevant details of the problem, (ii) Gong may, without any kind of liability to Customer, temporarily cease all Processing of the affected Customer Personal Data (other than securely storing such data) and/or suspend access to the Customer’s account, and (iii) if the parties do not agree on a resolution to the issue in question and the costs thereof, Customer may, as its sole remedy, terminate the Agreement and this DPA with respect to the affected Processing. Customer will have no further claims against Gong (including, without limitation, requesting refunds for the Services) pursuant to the termination of the Agreement and the DPA as described in this paragraph.

  + 2.5. CCPA Standard of Care; No Sale or Sharing of Customer Personal Information. Gong acknowledges and confirms that it does not receive or process any Customer Personal Information as consideration for any services or other items that Gong provides to Customer under the Agreement. As may be applicable to the Services provided under the Agreement, Gong certifies that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from selling or sharing (as such terms are defined in the CCPA) any Customer Personal Information Processed hereunder, without Customer’s prior written consent or instruction, nor take any action that would cause any transfer of Customer Personal Information to or from Gong under the Agreement or this DPA to qualify as “selling” and/or “sharing” such Customer Personal Information under the CCPA. Gong acknowledges that Customer discloses Customer Personal Information to Gong only for limited and specified business purposes (as such term is defined in the CCPA) set out in this DPA and the Agreement. Gong shall process all Customer Personal Information only (i) for such limited and specific business purpose(s), and (ii) in compliance with applicable sections of the CCPA, in a manner that provides the same or materially similar level of privacy protection as required of Customer considering the Customer Personal Information processed and industry standards. Gong shall not (i) retain, use, or disclose Customer Personal Information outside the direct business relationship of the parties, as described in the Agreement, or for any business or commercial purpose other than for the specific business purpose of performing the Services or as otherwise permitted by the Agreement and/or this DPA, nor (ii) combine Customer Personal Information with personal information Gong processes on behalf of other parties unless expressly permitted under the CCPA and the Agreement between the parties. As applicable to the Services provided, Gong shall implement reasonable security measures, as described in Section 7 of this DPA, as appropriate under the CCPA, and reasonably assist Customer or otherwise enable Customer to comply with its obligations relating to any request received from an individual under the CCPA, as described in Section 3 of this DPA. Customer shall inform Gong of any request received from an individual under the CCPA which requires Gong’s assistance in order to be fulfilled by Customer, and shall provide Gong all information necessary for it to assist with the request. Subject to the audit provisions in the Agreement and this DPA, Gong acknowledges that Customer has the right to take reasonable and appropriate steps to ensure that Gong uses Customer Personal Information in a manner consistent with Customer’s obligations under the CCPA. Gong further acknowledges that Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Information by Gong, subject to the conditions agreed upon in this DPA, including audit provisions. Gong shall notify Customer if Gong makes a determination that it can no longer meet its obligations under the CCPA.

  + Taking into account the nature of the Processing, Gong will reasonably assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to requests for exercising the Data Subjects' rights under the GDPR or other Data Protection Laws, to request access, rectification or deletion of Customer Personal Data, to restrict or object to further processing of such data, to receive a portable copy thereof, or to request not to be subject to automated individual decision-making. Gong will further reasonably assist Customer, upon Customer’s reasonable request, in ensuring compliance with Customer's obligations in connection with the security of Processing, notification of a Personal Data Breach to supervisory authorities and affected Data Subjects, Customer's data protection impact assessments and Customer's prior consultation with supervisory authorities, insofar as it relates to Gong's Processing of Customer Personal Data under this DPA, and to the extent Customer does not otherwise have access to the relevant information, and that such information is available to Gong. Except for negligible costs, Customer will promptly reimburse Gong with costs and expenses incurred by Gong in connection with the provision of assistance to Customer under this DPA.

  + 4.1. Limitation of Access. Gong will ensure that Gong’s access to Customer Personal Data is limited to those Personnel who require such access to perform the Agreement.

  + 4.2. Confidentiality. Gong will impose appropriate contractual obligations upon its Personnel engaged in the Processing of Customer Personal Data, including relevant obligations regarding confidentiality, data protection, and data security. Gong will ensure that its Personnel engaged in the Processing of Customer Personal Data are informed of the confidential nature of the Customer Personal Data, have received appropriate training in their responsibilities, and have executed written confidentiality agreements. Gong will ensure that such confidentiality agreements survive the termination of the employment or engagement of its Personnel.

  + 5.1. Gong may engage Sub-Processors to Process Customer Personal Data on behalf of Customer. Customer hereby provides Gong with a general authorization to engage the Sub-Processors listed at https://www.gong.io/sub-processors/. All Sub-Processors have entered into written agreements with Gong that bind them by data protection obligations substantially similar to those under this DPA. Where a Sub-Processor fails to fulfil its data protection obligations in connection with the Processing of Customer Personal Data under this DPA, Gong will remain fully liable to Customer for the performance of that Sub-Processor’s obligations.

  + 5.2. Gong may engage with a new Sub-Processor ("New Sub-Processor") to Process Customer Personal Data on Customer's behalf. Gong’s webpage accessible via https://www.gong.io/sub-processors offers a mechanism to subscribe to notifications of new Sub-Processors, to which Customer may subscribe. Gong shall provide notification of any new Sub-Processor(s) before authorizing such new Sub-Processor(s) to Process Customer Personal Data in connection with the provision of the Services. Customer may object to the Processing of Customer Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email protected] within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor. If Customer timely sends Gong a written objection notice, the parties will use good-faith efforts to resolve Customer's objection. In the absence of a resolution, Gong will use commercially reasonable efforts to provide Customer with the same level of service, without using the New Sub-Processor to Process Customer Personal Data.

  + 6.1. Transfers from the EEA, Switzerland, or the United Kingdom, to countries that offer adequate level of data protection. Personal Data may be transferred from EU Member States and the three EEA member countries (Norway, Liechtenstein and Iceland) (collectively, “EEA”), Switzerland, or the United Kingdom (“UK”), to countries that offer an adequate level of data protection pursuant to the adequacy decisions published by the relevant data protection authorities of the EEA, the European Commission, or Switzerland, or the UK as relevant (“Adequacy Decisions”), as applicable, without any further safeguard being necessary.

  + 6.3. Transfers from the EEA, Switzerland, or the United Kingdom, to other countries. If the Processing of Personal Data includes transfers (either directly or via onward transfer) from the EEA (“EEA Transfer”), Switzerland (“Swiss Transfer”), or the UK (“UK Transfer”) to other countries which have not been subject to a relevant Adequacy Decision (“Cross-Border Transfer”), and such transfers are not performed through an alternative recognized compliance mechanism as may be adopted by Gong and/or the parties for the lawful transfer of personal data (as defined in the GDPR) outside the EEA, Switzerland, or the UK, , as applicable, then (i) the terms set forth in Part 1 of Schedule 1 (EEA Cross Border Transfers) shall apply to any such EEA Transfer; (ii) the terms set forth in Part 2 of Schedule 1 (UK Cross Border Transfers) shall apply to any such UK Transfer; (iii) the terms set forth in Part 3 of Schedule 1 (Switzerland Cross Border Transfers) shall apply to any such Swiss Transfer; and (iv) the terms set forth in Part 4 of Schedule 1 (Additional Safeguards) shall apply to any such Cross-Border Transfers.

  − LAST UPDATED: August 2024

  − This Data Processing Addendum (“DPA”) forms part of the Gong Terms and Conditions, or other agreement governing the use of Gong’s services (“Agreement”) entered by and between you (“you”, “your”, “Customer”), and Gong.io Inc. (“Gong”). This DPA sets out the terms that apply to the Processing of Personal Data (as defined below) by Gong, on behalf of Customer, in the course of providing the Services to Customer under the Agreement.

  − 1.7. “Data Protection Laws” means all applicable and binding privacy and data protection laws and regulations in the locations where Gong operates the Services, including the GDPR, UK GDPR, and the CCPA.

  − 1.8. “Data Subject” means an identified or identifiable natural person to whom the Personal Data relates.

  − 1.9. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

  − 1.10. “Information Security Standards” means the security documentation applicable to the Services purchased by Customer, as updated from time to time, as made reasonably available to Customer by Gong.

  − 1.11. “Personal Data” or “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with a particular Data Subject or Consumer (as defined in the CCPA, to the extent applicable), which is included in Customer Data Processed by Gong on behalf of Customer under the Agreement, or such equivalent concept as defined under applicable Data Protection Laws.

  − 1.12. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by Gong on behalf of Customer under the Agreement.

  − 1.13. “Personnel” means persons authorized by Gong to Process Customer’s Personal Data.

  − 1.14. “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data pursuant to this DPA, whether or not by automatic means, such as collection, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure or destruction.

  − 1.15. “Processor” means the entity which Processes Personal Data on behalf of the Controller.

  − 1.16. “Sensitive Data” means Personal Data that is protected under a special legislation and requires unique treatment, such as “special categories of data”, “sensitive data” or other materially similar terms under applicable Data Protection Laws, which may include any of the following: (a) social security number, tax file number, passport number, driver’s license number, or similar identifier (or any portion thereof); (b) credit or debit card number; (c) financial, credit, genetic, biometric or health information; (d) information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences; and/or (e) account passwords in unhashed form.

  − 1.17. “Services” means the Gong Revenue Intelligence™ platform and products and services (and related Documentation) described on Customer’s ordering form(s).

  − 1.18. “Standard Contractual Clauses” means (a) in respect of transfers of Personal Data subject to the GDPR, the standard contractual clauses between controllers and processors, and between processors and processors (as applicable), as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including all annexes thereto (“EU SCCs”); (b) in respect of transfers of Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses of 21 March 2022 (version B.1.0), as incorporated into the EU SCCs through Schedule 1 Part 2 hereto (“UK Addendum”); and (c) in respect of transfers subject to the Federal Act on Data Protection (FADP – as revised as of 25 September 2020), the terms set forth in Schedule 1 Part 3 hereto (“Switzerland Addendum”).

  − 1.19. “Sub-Processor” means any third party service provider engaged by Gong that Processes Personal Data under the instruction or supervision of Gong.
• low 2026-09-30 · privacy policy +25 / −17 lines
  show diff

  + We process such Customer Data on behalf of and under the instruction of the respective Customer, in accordance with our Data Processing Addendum with them. Accordingly, this Privacy Policy (which describes Gong’s privacy and data processing practices) does not apply to the privacy and data processing practices of our Customers. To learn about the privacy policy and practices of our Customers, please contact them directly.

  + 2. User Data: personal data concerning individuals acting on behalf of our Customers in respect of their engagement with Gong, users of the Platform on behalf of such Customers (e.g., the account administrators and users, billing contacts and authorized signatories on behalf of the Customer), visitors of Gong’s Visioneer Community website and Gong Academy test takers (collectively, “Users”); as well as the Customer’s business needs and preferences, as identified to us or recognized through our engagement with them;

  + 3. Prospect Data: data relating to visitors of our website (www.gong.io), participants at our events, and any other prospective customer, user or partner (collectively, “Prospects”) who visits or otherwise interacts with our website, online ads and content, emails, integrations or communications under our control (the “Sites”, and collectively with the Platform, the “Services”).

  + 4. Office Visitor Data: personal data relating to individuals who visit our physical office locations ( “Office Visitor”).

  + 5. Professional Data: personal data relating to business professionals that we obtain from publicly available sources, third-party data providers, and other permitted sources in connection with Gong’s services, including enrichment features.

  + If you are a Customer, User, Prospect, Office Visitor or Professional please read this Privacy Policy carefully and make sure that you fully understand it.

  + Sometimes we collect personal data automatically when an individual interacts with our Platform or Sites (such as through our website chat feature) and sometimes we collect personal data directly from an individual. At times, we may collect personal data about an individual from other sources and third parties (such as our Customers, Service Providers, and third-party data providers), even before our first direct interaction. Gong does not collect, use, or disclose sensitive personal data.

  + * Information concerning Professionals that we obtain from publicly available sources, third-party data providers, and other permitted sources, such as name, job title, employer, business location, professional profile information, and other employment-related information.

  + Customer, User, Professional and Prospect personal data

  + Professional personal data

  + * To provide and support data enrichment and other related features of our Services (Legitimate Interests);

  + * To verify, cleanse, match, update, and maintain the accuracy of Professional Data (Legitimate Interests);

  + * To operate, maintain, secure, troubleshoot, and improve the systems and services used to provide these features (Legitimate Interests); and

  + * To respond to privacy rights and comply with applicable legal obligations (Legal Obligation).

  + Business Customers: Our Customers have access to personal data we process on their behalf in our capacity to them as a “processor” or a “service provider.” In connection with certain Services, including Gong Enrich, we may also use Professional Data to support the provision of those Services, such as to facilitate matching and enrichment. You may exercise your applicable privacy rights described in Section 9 below for Professional Data.

  + For the purposes of the CCPA, in the past 12 months, we may have disclosed the following categories of Personal Information, as defined in the CCPA: identifiers; customer record information; internet or other electronic network activity information; professional or employment-related information; geolocation data; commercial information; inferences; and audio, electronic and visual information We disclose Personal Information in pursuit of the business and commercial purposes described in Section 2 above.

  + Please note that opting out of promotional communications will not affect your receipt of important service-related communications, such as account notifications, security alerts, or transactional messages. For SMS communications, your mobile phone number and your consent to receive SMS messages will not be shared with third parties or affiliates for their own marketing or promotional purposes. Gong may share this information with service providers that support the delivery and operation of our SMS communications on our behalf.

  + Individuals have rights concerning their personal data. Please contact us by e-mail at: [email protected] if you wish to exercise your privacy rights under any applicable law, including but not limited to the EU or UK General Data Protection Regulation (GDPR), the Brazilian Data Protection Act (LGPD), the CCPA, or the Swiss Federal Act on Data Protection (FADP). Such rights may include – to the extent applicable – the right to know/request access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Gong, or to restrict or object to such personal data processing (including the right to direct us not to sell or share your personal data to third parties now or in the future, as described below), or to port such personal data, and you have the right not to receive discriminatory treatment for exercising your privacy rights (each to the extent available to you under the laws which apply to you). Under some regulatory frameworks, such as the GDPR, you may have the right to lodge a complaint with the relevant supervisory authority, as applicable. If you are an LGPD-protected individual, you also have the rights to confirmation of existence of processing; to request review of decisions made solely based on automatic decisions that affect your interests; to lodge a complaint with the supervisory authority and with consumer protection authorities in Brazil. If you believe that our processing of your personal data infringes applicable data protection law, or if you wish to make a complaint about how we have handled a data subject rights request, you may also submit a complaint directly to us (please see Section 12 below for information on how to make such a complaint).

  + For Professional Data, you may exercise your rights related to your personal data, here.

  + Gong is the “data controller” of Professional Data and Prospect Data. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Privacy Policy. In such instances, our Service Providers processing such data will assume the role of “data processor”.

  + Under some US data protection laws, like the CCPA, our processing of Professional Data as part of our Services may be considered a “sale” of personal information and our disclosure of certain internet activity and device information with third parties through cookies on our website may be considered a “sale” or “sharing” of personal information. We do so in pursuit of the business and commercial purposes described in Section 2 above.

  + For the purposes of the CCPA, in the last 12 months we may have sold Identifiers, Professional or employment related information, Geolocation data and Inferences to our Customers. We may have “sold” or “shared” Internet or other electronic network activity information, Geolocation data, Commercial information, and Inferences with our analytics and advertising Service Providers. Gong has not knowingly sold or shared the personal information of individuals under the age of 16.

  + For Professional Data, you can opt-out of the sale of your personal information through our Gong Enrich offering, here.

  + Questions, Concerns or General Complaints: If you have any comments or questions regarding our Privacy Policy, if you believe that our processing of your personal data infringes applicable data protection law or if you wish to make a complaint about how we process your personal data, please contact Gong’s support at [email protected] or our Data Protection Officer at [email protected]. We will acknowledge receipt of your complaint and will investigate and respond to it within applicable regulatory timeframes.

  + Last updated: 29 Sept 2026

  − 2. We process such Customer Data on behalf of and under the instruction of the respective Customer, in accordance with our Data Processing Addendum with them. Accordingly, this Privacy Policy (which describes Gong’s privacy and data processing practices) does not apply to the privacy and data processing practices of our Customers. To learn about the privacy policy and practices of our Customers, please contact them directly.

  − 3. User Data: personal data concerning individuals acting on behalf of our Customers in respect of their engagement with Gong, users of the Platform on behalf of such Customers (e.g., the account administrators and users, billing contacts and authorized signatories on behalf of the Customer), visitors of Gong’s Visioneer Community website and Gong Academy test takers (collectively, “Users”); as well as the Customer’s business needs and preferences, as identified to us or recognized through our engagement with them;

  − 4. Prospect Data: data relating to visitors of our website (www.gong.io), participants at our events, and any other prospective customer, user or partner (collectively, “Prospects”) who visits or otherwise interacts with our website, online ads and content, emails, integrations or communications under our control (the “Sites”, and collectively with the Platform, the “Services”).

  − 5. Office Visitor Data: personal data relating to individuals who visit our physical office locations ( “Office Visitor”).

  − If you are a Customer, User or Prospect, please read this Privacy Policy carefully and make sure that you fully understand it.

  − Sometimes we collect personal data automatically when an individual interacts with our Platform or Sites (such as through our website chat feature) and sometimes we collect personal data directly from an individual. At times, we may collect personal data about an individual from other sources and third parties (such as our Customers and Service Providers), even before our first direct interaction. Gong does not collect, use, or disclose sensitive personal data.

  − Customer, User and Prospect personal data

  − Business Customers: Our Customers have access to personal data we process on their behalf in our capacity to them as a “processor” or a “service provider.”

  − For the purposes of the CCPA, in the past 12 months, we may have disclosed the following categories of Personal Information, as defined in the CCPA: identifiers; customer record information; internet or other electronic network activity information; professional or employment-related information; geolocation data; commercial information; inferences; and audio, electronic and visual information to Service Providers, partnerships, service integrations, Gong subsidiaries and affiliated companies, for legal compliance, or to protect rights and safety. We may have disclosed identifiers and customer record information to event sponsors. Through participation in the Gong Visioneer Community, you may disclose identifiers and customer record information. We disclose Personal Information in pursuit of the business and commercial purposes described in Section 2 above.

  − Mobile Information and SMS Compliance: Notwithstanding anything to the contrary in this Privacy Policy, no mobile information or personal data collected via our text messaging programs will be shared with third parties, partners, or affiliates for marketing or promotional purposes. All the above categories of data sharing exclude text messaging originator opt-in data and consent; this specific information will not be shared, sold, or rented to any third parties.

  − Please note that opting out of promotional communications will not affect your receipt of important service-related communications, such as account notifications, security alerts, or transactional messages. For SMS communications, your mobile phone number and your consent to receive SMS messages will not be shared, sold, or rented with third parties, affiliates, or partners for marketing or promotional purposes. Gong may share this information with service providers that support the delivery and operation of our SMS communications on our behalf.

  − Individuals have rights concerning their personal data. Please contact us by e-mail at: [email protected] if you wish to exercise your privacy rights under any applicable law, including but not limited to the EU or UK General Data Protection Regulation (GDPR), the Brazilian Data Protection Act (LGPD), the CCPA, or the Swiss Federal Act on Data Protection (FADP). Such rights may include – to the extent applicable – the right to know/request access to (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties with whom we have shared personal data), to request rectification or erasure of your personal data held with Gong, or to restrict or object to such personal data processing (including the right to direct us not to sell or share your personal data to third parties now or in the future, as described below), or to port such personal data, and you have the right not to receive discriminatory treatment for exercising your privacy rights (each to the extent available to you under the laws which apply to you). If you are a GDPR-protected individual, you also have the right to lodge a complaint with the relevant supervisory authority in the EU or the UK, as applicable. If you are an LGPD-protected individual, you also have the rights to confirmation of existence of processing; to request review of decisions made solely based on automatic decisions that affect your interests; to lodge a complaint with the supervisory authority and with consumer protection authorities in Brazil.

  − Gong is the “data controller” of Prospect Data. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Privacy Policy. In such instances, our Service Providers processing such data will assume the role of “data processor”.

  − Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information with third parties through cookies on our website may be considered a “sale” or “sharing” of personal information. We do so in pursuit of the business and commercial purposes described in Section 2 above.

  − For the purposes of the CCPA, in the last 12 months we may have “sold” or “shared” Internet or other electronic network activity information, Geolocation data, Commercial information, and Inferences with our analytics and advertising Service Providers. Gong has not knowingly sold or shared the personal information of individuals under the age of 16.

Fact changes

• low 2026-10-01 · 0 field change(s), +0/−2 subprocessors, +0 model providers
• high 2026-09-15 · 0 field change(s), +2/−0 subprocessors, +1 model providers
• medium 2026-09-05 · 1 field change(s), +0/−0 subprocessors, +0 model providers

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.