For Services and other covered personal data received in reliance on the DPF.  

Certification 

Bentley Systems, Incorporated (“Bentley”) participates in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union, European Economic Area, the United Kingdom and Gibraltar, and Switzerland, as applicable, to the United States in reliance on the DPF. Bentley has certified to the U.S. Department of Commerce that it adheres to the DPF Principles with respect to such data. If there is any conflict between this notice and the DPF Principles, the DPF Principles govern for personal data received in reliance on the DPF. To learn more about the DPF program, and to view Bentley’s certification, please visit the U.S. Department of Commerce Data Privacy Framework Program website at https://www.dataprivacyframework.gov/.  

Scope  

This notice applies to personal data relating to individuals located in the European Union, European Economic Area, the United Kingdom and Gibraltar, and Switzerland that Bentley receives in the United States in reliance on the DPF (collectively, “Covered Individuals”). Bentley will comply with this notice and the DPF Principles with respect to such personal data.  

Data Processed  

Bentley is a software development company that supports architects, engineers, constructors, and owner-operators with comprehensive architecture and engineering solutions for advancing infrastructure. Bentley may receive personal data in reliance on the DPF from users, accounts, website visitors, business partners, candidates, colleagues, affiliates, and other individuals, depending on the relevant interaction and applicable service. This may include account and contact information, business contact details, registration information, purchase and contracting information, support information, usage and licensing information, candidate and HR-related information where applicable, and other information described in Bentley’s Privacy Statement or applicable privacy notice. In providing products and services to business accounts or users (collectively, “Subscribers”), Bentley may also process data, including personal data, that Subscribers submit to Bentley services or instruct Bentley to process on their behalf, as described in Bentley’s Data Processing Addendum. While Subscribers decide what data to submit to Bentley services, such data may include names, contact information, company information, email addresses, telephone numbers, physical business addresses, user identifiers, and any personal data stored by the Subscriber in Bentley’s cloud environment. Where Bentley receives candidate, colleague, or other HR-related personal data in reliance on the DPF, Bentley processes that data for the purposes described in the applicable candidate, colleague, or internal privacy notice.  

Purposes of Data Processing  

Bentley processes personal data received in reliance on the DPF for purposes described in Bentley’s Privacy Statement, Data Processing Addendum, applicable candidate or colleague privacy notices, and relevant agreements. These purposes may include providing requested products and services; administering accounts, registrations, licenses, and transactions; providing technical support and customer service; improving and securing Bentley offerings; performing sales and marketing activities where permitted by applicable law; conducting internal business processes such as financial processing, fraud detection and prevention, compliance, and legal operations; processing candidate or HR-related information where applicable; and following Subscriber instructions or contractual requirements where Bentley acts as a processor or service provider.  

Third-Party Transfers 

Bentley may disclose personal data to affiliates, service providers, subprocessors, professional advisers, business partners, or other third parties as described in Bentley’s Privacy Statement and applicable agreements. Where Bentley transfers personal data onward to a third party acting as an agent, Bentley requires that party by contract to process the data only for limited and specified purposes and to provide at least the same level of protection required by the DPF Principles. Bentley remains responsible under the DPF Principles if its agent processes such personal data in a manner inconsistent with those Principles, unless Bentley proves that it is not responsible for the event giving rise to the damage.  

Rights to Access and Limit Use and Disclosure  

Covered Individuals have rights to access personal data about them and to limit the use and disclosure of their personal data as provided by the DPF Principles. Bentley has committed to respect those rights. If you seek to access, correct, delete, or limit the use or disclosure of your personal data, please contact Bentley’s Data Protection Officer or use the contact methods described in Bentley’s Privacy Statement. Where Bentley receives such a request and processes the relevant personal data on behalf of a Subscriber, Bentley may refer the request to that Subscriber or support the Subscriber in responding, consistent with Bentley’s contractual obligations.  

U.S. Federal Trade Commission Enforcement  

Bentley’s commitments under the DPF are subject to the investigatory and enforcement powers of the United States Federal Trade Commission.  

Compelled Disclosure  

Bentley may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.  

Independent Dispute Resolution and Arbitration  

If you have an inquiry or complaint related to Bentley’s DPF compliance, please contact Bentley’s Data Protection Officer. Bentley will respond to your inquiry within forty-five (45) days. If Bentley cannot resolve your complaint, Bentley has designated the International Centre for Dispute Resolution division of the American Arbitration Association (“ICDR-AAA”) as an independent dispute resolution body to review DPF-related complaints at no cost to you. Please visit the ICDR-AAA DPF independent recourse mechanism at https://go.adr.org/dpf_irm.html. If your complaint cannot be resolved directly with Bentley or through the independent dispute resolution mechanism, you may be able to invoke binding arbitration through the DPF Panel. For more information on this option, please see Annex I of the DPF Principles. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.  

Where Bentley receives human resources data in reliance on the DPF, including personal data relating to colleagues and job candidates collected in the context of the employment relationship, Bentley further commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (“DPAs”), the UK Information Commissioner’s Office (“ICO”) and the Gibraltar Regulatory Authority (“GRA”), and the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) with regard to unresolved DPF complaints concerning such human resources data transferred from the European Union, the United Kingdom (including Gibraltar), and Switzerland. If you have such an unresolved complaint, please contact the applicable DPA, the ICO, the GRA, or the FDPIC (free of charge). Under certain conditions, you may have the possibility to engage in binding arbitration to resolve residual disputes; for more information, please see Annex I of the DPF Principles.