Prism Privacy Notice

Effective: 2026-09-27 · Version 2.0

Who we are

Prism is a maturity assessment platform operated by Veeam. The controller of personal data processed through Prism is the Veeam entity identified as the controller in the Veeam Privacy Notice, which this notice supplements. For questions about Prism and your data, contact m.ruffin@veeam.com. Veeam's Data Protection Officer can be reached as described in the Veeam Privacy Notice.

Anonymized by design

Organizations and engagements in Prism are anonymized: the platform does not store an organization's name, and survey participants are identified by their role and a randomly generated access token rather than by name. Where a participant chooses to receive a survey link by email, that address is used only to deliver the link and is stored in an encrypted form

What we process

Depending on how you use Prism: business contact details and sign-in information for people who administer or are given access to assessments; a participant's role and survey answers; technical information such as IP address and device or browser data collected when you visit the site; information you submit when you exercise your privacy rights; and, with your consent, performance data about how the site behaves in your browser. Prism does not ask for special categories of personal data.

Why, and on what basis

We process this data to run assessments and workshops and produce their results, including text generated with the help of artificial intelligence; to produce anonymized industry benchmarks that contain no personal data; to keep the platform secure and prevent misuse; to respond to requests and meet legal obligations; and, for optional performance data, because you consented. Our legal bases are the performance of our engagement with your organization, our legitimate interests in providing and securing the service, your consent where we ask for it, and compliance with the law. No decision with legal or similarly significant effect on you is made by automated means; assessment outputs are reviewed by people.

Who receives it

Veeam and its affiliates, service providers that host, secure, deliver email for, and provide AI processing for the platform, acting on Veeam's instructions; the organization that engaged Veeam, for its own results; and authorities where the law requires. We do not sell personal data or share it for advertising.

Where it is processed

Your organization's data is stored in the region selected for it. Some processing takes place in other countries, including countries that may not provide the same level of data protection as yours. Where that happens, Veeam relies on the safeguards described in the Veeam Privacy Notice, such as approved standard contractual clauses.

How long do we keep it

For as long as needed for the engagement and the purposes above, after which data is deleted or anonymized in line with Veeam's retention schedule. Security and audit records are retained for the period required by Veeam's policies. Anonymized benchmark data, which contains no personal data, may be kept indefinitely.

Your rights

Depending on where you live, you may access, correct, delete, or receive a copy of your personal data, object to or restrict its processing, withdraw consent, and complain to a supervisory authority. Residents of some US states have equivalent rights, including the right not to be discriminated against for exercising them. We honor Global Privacy Control signals as an opt-out. To exercise a right, use our rights request form or write to m.ruffin@veeam.com. We will verify your identity before acting and respond within the time allowed by law.

Cookies

See our Cookie Policy for the cookies Prism uses and how to control them.

Children

Prism is a business platform and is not directed at anyone under 18.

Changes

We will post updates to this notice here with a new effective date.