CrowdStrike Global Privacy Notice

Version 1.7

Effective Date: March 31, 2026

CrowdStrike, a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data. Powered by the CrowdStrike® Security Cloud and world-class artificial intelligence (AI), the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across an enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities. Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value. For more information about CrowdStrike, please see the “About Us” section of our website at https://www.crowdstrike.com/about-crowdstrike/.

This Global Privacy Notice (“Notice”) describes the manner in which CrowdStrike, Inc. and related companies (collectively, “CrowdStrike”) may use, maintain and disclose information that we collect from you when you visit or interact with CrowdStrike’s social media platforms, our websites (e.g., crowdstrike.com, supportportal.crowdstrike.com, falcon.crowdstrike.com, crowdstrike.org, marketplace.crowdstrike.com, grid.crowdstrike.com, partner.crowdstrike.com, university.falcon.crowdstrike.com, developer.crowdstrike.com; collectively, “Websites”), sign up to attend or participate in an event or webinar, download a white paper or other materials, and inquire about our “Offerings,” which include CrowdStrike’s cloud-based software, technical support, training and professional services like incident response, investigations, tabletop exercises, forensics and next-generation penetration tests related to cybersecurity. For purposes of this Notice, the terms “user,” “you” and “your” are meant to refer to the individuals about whom we may collect personal information, and at times, these terms may be used within this Notice interchangeably. You can see a list of related companies below.

If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Notice. At any time, you can manage your privacy preferences by visiting our Preference Center. If you are a job applicant, please refer to our Candidate Privacy Notice. Our Websites include links to other websites whose privacy practices may differ from those of CrowdStrike. If you submit personal information to any of those sites or services, your information is governed by their privacy notices. We encourage you to carefully read the privacy notice of any website you visit.

For individuals located in the European Union, CrowdStrike has appointed CrowdStrike GmbH as its representative in the European Union in accordance with Article 27 of the General Data Protection Regulation (“GDPR”). EU-based individuals may contact CrowdStrike GmbH in addition to, or instead of, CrowdStrike, Inc. regarding matters related to this Notice. Contact information for CrowdStrike GmbH can be found below in Section 10.

CrowdStrike’s Websites and Offerings are not directed at children, and CrowdStrike does not knowingly collect or sell personal information from individuals under the age of 16. 

This Notice does not apply to the information our customers upload or provide to us when they use our Offerings. To learn about how we protect our customers’ personal information, please review our Global Data Protection Agreement   This Notice also does not apply when a responsible third party, such as a CrowdStrike partner, collects and uses your personal information. For example, if you purchase a third-party connector or solution via marketplace.crowdstrike.com, then the privacy practices of that third party will apply to your purchase and use of that connector or solution. We encourage you to carefully review the privacy notice of such third parties.

We recommend that you read this Notice in its entirety to ensure you are fully informed. However, for easy access to information, you can click on the links below to jump to the relevant section:

1. What Types of Personal Information Do We Collect?
2. When Do We Collect Your Personal Information?
3. How Do We Use Your Personal Information?
4. What Sources Provide Us with Personal Information?
5. Does CrowdStrike Share Your Personal Information?
6. What Is CrowdStrike's Legal Basis for Processing Personal Data?
7. Security Safeguards
8. Retention of Personal Data
9. Adherence to Privacy Frameworks
   • EU-U.S., U.K. and Swiss Data Privacy Frameworks
   • Asia-Pacific Economic Cooperation (APEC) Privacy Framework
10. Individual Privacy Rights
11. Updates to This Notice
12. Other CrowdStrike Companies
    

1. What Types of Personal Information Do We Collect?

These are the categories of personal information we may collect from you:

1. Business Contact Personal Information: Your first name, last name, job title, employer name, work address, work email and work telephone number. If you or a partner choose to provide us with other information, like your personal email address, telephone number or mailing address, then CrowdStrike will collect this information, too.
2. Technical and Device Information: Your Internet Protocol (IP) address, browser information, device ID, type of computer and technical information about how you connect to our Websites and social media platforms, such as the operating system and the internet service provider utilized. If you are required to log in to gain access to a particular Website feature or portal, we collect usernames, passwords and other login credentials to authenticate access.
3. Financial and Subscription Information: If you make a purchase, then CrowdStrike will collect credit/debit card numbers or data about other types of payment used.
4. Audio and Visual Data: If you attend or give a presentation during a CrowdStrike-hosted in-person or virtual event, participate in a webinar or agree to be recorded during a telephone conversation or virtual meeting, we may record and store your voice and image and collect other personal information you provide to us, like your professional biography. If you choose to personalize your account with a photo or social media profile, then CrowdStrike will collect this information, too. We may document events in other ways, too, such as by taking photographs, conducting interviews and recording participation in a live question-and-answer session.
5. Cookies and Analytics Data: CrowdStrike and our third-party service providers use cookies, local storage (HTML5), scripts and similar technologies with all our Websites and some social media platforms so they function properly. We use such technologies to continuously improve our Websites and to customize your experience when you visit them. To some extent, cookies and analytics technologies help us provide you with custom, personalized content (including targeted advertising), identify you across multiple devices and monitor aggregate metrics such as total number of visitors, traffic, usage and demographic patterns.
6. Feedback Data: Through our Websites and social media platforms, CrowdStrike makes available various online community forums and blogs. You may choose to participate with these resources by interacting with us, interacting with other users or adding your own posts. CrowdStrike may invite you to participate in studies or otherwise provide feedback about your experience. If you do so, then CrowdStrike considers your participation and your posts to be freely given, and we may collect and use your feedback without compensation or attribution to you. However, we're under no obligation to publish, maintain or retain any of your posts.
7. Personal Information About California Consumers Subject to the California Consumer Protection Act (“CCPA”): In the preceding 12 months, CrowdStrike has collected the following categories of personal information about California consumers. We may collect this personal information directly from you, from third parties and from your interactions with our Websites and social media platforms. As defined by the CCPA, the personal information categories are:
   
   • Business contact information, including identifiers such as name, email address, address and phone number
   • Commercial information, such as records of Offerings purchased and other transactional data
   • Internet or other network or device activity details, such as technical data about your use of our Websites or social media platforms
   • Geolocation data, such as your approximate location based on IP address
   • Audio, electronic or visual data, such as part of a photo or recording for a CrowdStrike in-person or virtual event

You can opt out of the sale/share of your personal information by submitting a request via our Opt-Out Form, by emailing your request to privacy@crowdstrike.com or by clicking the Your Privacy Choices link at the bottom of www.crowdstrike.com and following the directions provided on that page.

2. When Do We Collect Your Personal Information?

Business Contact Personal Data: CrowdStrike collects your business contact information when you:

• Sign up to attend or participate in an in-person event or webinar
• Sign up for a contest or promotion
• Sign up for SMS or email alerts or notifications related to our Offerings
• Download a white paper or other materials
• Agree to be recorded during a telephone conversation or virtual meeting
• Log in to a Website feature or portal
• Visit a CrowdStrike office
• Participate in a partner reward program (e.g., CrowdCard)

Technical and Device Information: CrowdStrike collects your technical and device information when you:

• Visit our Websites and social media platforms
• Log in to a Website feature or portal
• Sign up for and use a free product trial

Financial and Subscription Information: CrowdStrike collects your financial and product subscription information when you:

• Purchase Offerings
• Sign up to attend or participate in a live event or webinar for which CrowdStrike charges a fee

Audio and Visual Data: CrowdStrike collects your audio and visual data when you:

• Attend a CrowdStrike-hosted in-person or virtual event
• Attend a partner-hosted in-person or virtual event
• Participate in a recorded telephone or conference call conversation
• Choose to personalize your account with additional information, such as a photo or social media profile

Cookies and Analytics Technologies: CrowdStrike uses cookies and analytics technologies when you:

• Visit our Websites and social media platforms
• Log in to a Website feature or portal
• Sign up for and use a free product trial

If you would prefer not to be tracked, most browsers will allow you to (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies — however, doing so may affect how our Websites work. For further information regarding CrowdStrike's use of cookies and how to set your cookie preferences, please refer to the CrowdStrike Cookie Notice.

Feedback Data: CrowdStrike will collect your feedback when you:

• Participate in our online community forums and blogs
• Respond to CrowdStrike polls and questionnaires

If you interact with CrowdStrike, interact with other users or add your own posts, then CrowdStrike considers your participation and your posts to be freely given, and we may use your feedback without compensation or attribution to you. CrowdStrike is under no obligation to publish, maintain or retain any of your posts.

3. How Do We Use Your Personal Information?

CrowdStrike may use your personal information to:

• Provide you with information about our Offerings and send you reports, white papers and other resources that you specifically requested to receive from us
• Manage accounts that you create with us
• Send you SMS or email alerts or notifications related to our Offerings
• Send you information about CrowdStrike Offerings that we believe you may be interested in when you have not opted out of receiving such marketing materials
• Analyze your feedback through surveys or research
• Contact you when a partner or other third party makes a referral to us and we reasonably believe that they have your consent or another lawful basis for providing your personal information to CrowdStrike. A partner is a separate organization that collaborates with CrowdStrike to deliver cybersecurity solutions, services or Offerings to customers. You can learn more about our partners at CrowdStrike Partners
• Monitor and keep secure our equipment, intellectual property, physical office locations, Offerings, Websites, accounts on social media platforms and technology assets
• Diagnose and fix problems related to our Offerings
• Maintain endpoint and network security
• Prevent, investigate or provide notice of fraud or unlawful or criminal activity
• Comply with contractual, legal and regulatory obligations
• Enforce the Terms and Conditions that we agree to with our customers and those who decide to try out our Offerings before purchasing them via evaluations and free trials.
• Carry out a corporate transaction, such as a merger or sale of assets of all or part of our company
• Comply with a subpoena or similar legal process or request
• Protect your safety or the safety of others
• Interact with our professional advisors (such as auditors, insurance companies, financial service providers and attorneys) as needed for us to run our business
• Inform third parties (including partners and resellers of our Offerings) to the extent that you consent to such sharing (where required by applicable law) or expressly direct us to interact with such third parties

In the preceding 12 months and where applicable, we have disclosed each of these categories to our service providers, affiliates, partners, resellers and event sponsors, in line with the applicable purpose(s) described above. Business contact information provided by customers for SMS or email alerts or notifications related to our Offerings is not disclosed to third parties for marketing or advertising purposes and is treated in accordance with CrowdStrike Terms and Conditions.

4. What Sources Provide Us with Personal Information?

As described above, CrowdStrike collects personal information from you when you interact with us online or in person. We also collect your personal information from other sources when we reasonably believe that they have your consent or another lawful basis for providing your personal information to CrowdStrike.

Other sources of personal information include:

• Partners and resellers that market and sell our Offerings
• CrowdStrike-related companies
• Social media platforms
• Data brokers
• Providers that make user-generated content available to others, such as local business reviews or public social media posts
• Communication services, including email providers and social networks, when you give us permission to seek personal information from these sources
• Referrers, who may share a contact's name and email address with us using a referral option

5. Does CrowdStrike Share Your Personal Information?

When we collect and use your personal information as described in this Notice, CrowdStrike may share it with those listed below:

• CrowdStrike-related companies
• Service providers as necessary to provide our Offerings
• Service providers as necessary to fulfill a request made by you
• CrowdStrike professional advisors, such as auditors, insurance providers, financial service providers and attorneys
• Public authorities, as required by law to comply with a subpoena or similar legal process or to protect CrowdStrike or its customers
• Customers as necessary to prevent or investigate alleged fraud or other unlawful criminal activity
• Online content technology providers
• Advertisers. You may opt out by visiting Digital Advertising Alliance's self-regulatory opt-out page here. If you are located in the European Economic Area, click here. Please note this does not opt you out of being served ads; you will continue to receive generic ads
• Event sponsors. In addition to this Notice, your personal information is subject to sponsors' privacy practices
• Contest and promotion sponsors
• Partners and resellers that sell our Offerings
• Your employer/organization

In the preceding 12 months, we have disclosed certain categories of personal information described above to third-party advertising partners, such as in connection with our use of tracking technologies for cross-context behavioral advertising or by providing lists of email addresses for potential customers so that we can reach you across the internet with advertisements for our Offerings. This may be considered “sharing” or a “sale” under the CCPA. Business contact information provided by customers for SMS or email alerts or notifications related to our Offerings is not disclosed to third parties for marketing or advertising purposes and is treated in accordance with CrowdStrike Terms and Conditions.

6. What Is CrowdStrike's Legal Basis for Processing Personal Data?

If the law requires us to have a legal reason for collecting and using your personal information, such as the European Union or United Kingdom General Data Protection Regulation (either, the “GDPR”), then the reason will depend on the type of information we collect and why we collect it. When you interact with CrowdStrike as a representative of a customer or sign up for a free trial, we use your personal information either because you gave us permission (where required by law) or because we need it to fulfill an agreement we have with you or your company.

When you fill out a form to ask about CrowdStrike or one of our Offerings, we use your personal information either with your permission (where required by law) or because it's in our legitimate interest to respond to your request, communicate with you and send you information about our Offerings (like via marketing calls or emails, depending on your preferences).

If you sign up for newsletters or events, request a demo, download resources or take part in surveys, we use your consent to send you more information about our Offerings that we think might interest you. You can opt out of these communications at any time by using one of the methods described in Section 10 (Individual Privacy Rights).

We also rely on your consent when it comes to using cookies on our websites. You agree to this when using our sites, although cookie rules can vary based on where you are located.

If we need to use your personal information based on our legitimate interests, we will tell you this when collecting the data. Our legitimate interests include things like running our websites, communicating with you when you ask for information and marketing our Offerings.

Sometimes, we also need to process your information to meet legal requirements, like keeping business records or complying with tax laws.

7. Security Safeguards

We adopt data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information, and we follow generally accepted practices to protect such data.

For your own safety, please note that the security of data transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other form of authentication involved in accessing password-protected or secured areas of any CrowdStrike portal. Access to and use of password-protected and/or secure areas of any CrowdStrike portal is restricted to authorized users only.

For more information on security measures, please contact the Vice President, Privacy, CrowdStrike (see Section 10 below). You may also access certain information at CrowdStrike's Trust Center.

8. Retention of Personal Data

Subject to the conditions and restrictions set out under applicable laws or privacy frameworks (see Section 9 below), we will retain your personal information for as long as needed to fulfill the purpose for which we collected it and for a reasonable period thereafter to comply with audit, contractual or legal requirements or where we have a legitimate interest in doing so. We may retain aggregated or de-identified data indefinitely or to the extent allowed by applicable law. We may retain personal information in computer backup or archival copies generated in the ordinary course of our business.

9. Adherence to Privacy Frameworks

As a global organization, CrowdStrike may need to transfer your personal information outside your home jurisdiction to CrowdStrike affiliates, including our headquarters in the United States, and other countries where our service providers operate. These countries may have data protection laws that are different from the laws of your region. We will only transfer your personal information to another country in accordance with applicable data protection laws and provided there is adequate protection in place for the data (e.g., through an adequate mechanism for the international transfer of personal information). These mechanisms include written data processing agreements or other appropriate safeguards, as established in the GDPR or voluntary privacy frameworks made to improve general data privacy and safeguard the cross-border transfer of personal information (“Privacy Frameworks”).

EU-U.S., U.K. and Swiss Data Privacy Frameworks

CrowdStrike complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. CrowdStrike has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. CrowdStrike has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The Federal Trade Commission has jurisdiction over CrowdStrike’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, CrowdStrike may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In the context of onward transfers, CrowdStrike is accountable for the processing of personal data it receives, under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transfers to a third party acting as an agent on its behalf. CrowdStrike remains liable under the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles if the CrowdStrike’s agent processes personal information in a manner inconsistent with the EU-U.S. DPF Principles, and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, unless the CrowdStrike proves that it is not responsible for the event giving rise to damage.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, CrowdStrike commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact CrowdStrike at: privacy@crowdstrike.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, CrowdStrike commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.trustarc.com/watchdog/request for more information or to file a complaint. These dispute resolution services are provided at no cost to you.

For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration. Further information can be found on the official DPF website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Asia-Pacific Economic Cooperation (APEC) Privacy Framework

CrowdStrike's privacy practices, described in this Notice, comply with the APEC Cross-Border Privacy Rules (“CBPR”) System. The APEC system provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. Additional details about the APEC framework can be found here. To check the status of CrowdStrike’s CBPR certification, click here.

Global Privacy Framework

CrowdStrike’s privacy practices, described in this Notice, comply with the Global Cross-Border Privacy Rules (“CBPR”) System. The Global CBPR Forum enables trusted data flows globally through international data protection and privacy certification. To check the status of CrowdStrike’s Global CBPR certification, click here.

10. Individual Privacy Rights

Subject to the conditions and restrictions set out under applicable law and/or Privacy Frameworks, you may have the following rights:

• You may request access to, and correction or deletion of, your personal information
• You may object to the processing of your personal information, ask us to restrict its processing and request that we provide your personal information to certain third parties
• You may have the right to complain to CrowdStrike and/or a data protection authority about CrowdStrike's collection and use of your personal information

If you have consented to CrowdStrike's collection and use of your personal information, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal information conducted in reliance on another lawful basis.

If your employer is a CrowdStrike customer, then please contact them directly if you wish to exercise your privacy rights concerning your personal information, which they provide to CrowdStrike to process for them. Under applicable law and the agreements we have in place with our customers, CrowdStrike cannot respond directly to your request in this event.

If you are a California resident, then the CCPA applies to you, and you may have the right to:

• Know what kind of personal information we collect about you and how we use, disclose, share and sell it
• Request that we correct inaccurate personal information
• Instruct us to delete your personal information
• Opt out of the sale or sharing of your personal information. CrowdStrike shares personal information as described above in Section 5, which may be considered a “sale” of personal information under the CCPA
• Limit the use or disclosure of your sensitive personal data. CrowdStrike does not collect, share or sell sensitive personal data
• Not receive discriminatory treatment from CrowdStrike for exercising your privacy rights under the CCPA
• Designate an authorized agent to make a request on your behalf when exercising your privacy rights under the CCPA

You may exercise your privacy rights by completing our Individual Privacy Right Request Form or by emailing your request to privacy@crowdstrike.com. When you do so, please provide your complete name and your email address, which we'll use to communicate with you. CrowdStrike will use this information only to verify you and process your request. If you are an authorized agent, then we reserve the right to request you demonstrate evidence of your authorization, either by providing us with a signed permission form or a copy of your power of attorney granting you such authority.

If you're a California resident, then you can opt out of the sale/share of your personal information by submitting a request via our Opt-Out Form, by emailing your request to privacy@crowdstrike.com or by clicking the Your Privacy Choices link at the bottom of www.crowdstrike.com and following the directions provided on that page. You may also opt out by using an opt-out preference signal, such as the Global Privacy Control (“GPC”). Please note that unless you have previously provided your personal information to CrowdStrike, your request to opt out via GPC will be linked to your browser identifier only because CrowdStrike does not have any of your personal information with which to associate your GPC opt-out directive.

From the period of January 1, 2024, to January 1, 2025, CrowdStrike received eleven verifiable requests from California consumers.

If you have any questions about this Notice, please contact us at:

Chief Privacy and Policy Officer

CrowdStrike

150 Mathilda Place

Sunnyvale, CA 94086

privacy@crowdstrike.com

EU Representative (Article 27 GDPR)

CrowdStrike GmbH

c/o Citco Deutschland GmbH

Marienstr. 15

60329 Frankfurt am Main

Germany

privacy@crowdstrike.com

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Pursuant to Article 27 GDPR, CrowdStrike has appointed CrowdStrike GmbH as its representative in the European Union. CrowdStrike GmbH acts as a point of contact for supervisory authorities and individuals in the European Union on issues related to the processing of personal data under this Notice.

11. Updates to This Notice

We may update this Notice and its effective date at any time to reflect changes to our practices. We encourage you to periodically review this Notice for the latest about our privacy practices.

12. Other CrowdStrike Companies