monday.com Foundation
Privacy Policy

This Privacy Policy describes how the monday.com Foundation Ltd. (together with our affiliated companies – “monday.com Foundation”, “we”, “our” or “us”), collects, stores, uses, discloses and otherwise processes personal data relating to identified or identifiable individuals (“personal data” or “personal information”) who interact with us. Specifically, this Privacy Policy outlines our practices regarding the personal data of the following individuals:

i. Visitors: who visit or otherwise interact with our websites, including www.monday-foundation.org and https://mondayert.org/, or any other website, webpage, e-mail, text message or digital ad related to the monday.com Foundation, participate in any of our events, interact with any of our online ads and content, emails, marketing channels, integrations or communications under our control, except for the Tech School website, which has a different Privacy Policy (see below) (collectively – “Sites”);

ii. mondayERT Participants and Partners: team members, partners and ambassadors who participate in, engage or interact with the monday.com Foundation Emergency Response Team service (“mondayERT”), to the extent the monday.com Foundation acts as a data controller with respect to the personal data of such Participants and Partners (e.g., referral information);      

iii. monday.com Foundation Community: members of the monday.com Foundation community, including members of non-profit organisations that we connect with, sponsor and facilitate engagements with, and individuals who interact with us via any other products, applications, tools, community activities, or any ancillary or supplementary monday.com Foundation products or services (together with the Sites and mondayERT, the “Services”).

‍

For Tech School Participants and organizers: the monday.com Foundation has  a separate Privacy Policy for monday.com Foundation Tech School program coordinators/organizers and Tech School participants/students who are registered to, use, interact with or participate in the Tech School program. If you participate in the Tech School program, please see the dedicated Tech School Privacy Policy here: Tech School Israel program; Tech School US program.

‍

This Privacy Policy describes our practices regarding:

1. Data Collection & Processing
2. Data Uses & Legal Bases
3. Data Location
4. Data Retention
5. Data Disclosure
6. Cookies and Tracking Technologies
7. Communications
8. Data Security
9. Data Subject Rights
10. Data Controller/Processor
11. Additional Notices

Please read this Privacy Policy carefully and make sure that you fully understand and agree to it. You are not legally required to provide us with any of your personal data, and may do so (or avoid doing so) at your own free will. If you prefer not to provide us with your personal data, or to have it processed by us or any of our service providers, please refrain from visiting or interacting with our Sites, or using our Services. 

You may also choose not to provide us with “optional” personal data (i.e. “not required” fields on forms), but please keep in mind that without it, we may not be able to provide you with the full range of our Services or with the best experience when using or interacting with our Services.

Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in our Website Terms of Use.
‍

1. Data Collection & Processing

‍ We collect or generate the following categories of personal data:

• Usage and device information: Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (like type, operating system, mobile device or app id, browser version, location and language settings used), activity logs, the relevant cookies and pixels installed or utilized on your device, and the recorded activity (sessions, clicks, use of features, logged activities and other interactions) in connection with our Services.
  We collect and generate this information automatically, including through the use of analytics tools (including cookies and pixels) which collect data such as: how often you visit or use the Services, which pages you visit and when, which website, ad or email message brought you there, and how you interact with and use the Services.

• Contact, profile and account information: Including contact details such as name, email, phone number, position, workplace, professional information, company, position, country, and any expressed, presumed or identified needs, preferences, attributes and insights relevant to our engagement with you or your organization, and contract and account details (to the extent relevant, for example, to receive donations from the monday.com Foundation). We also collect profile pictures and any other information submitted by you or other users, or that is otherwise available to us when you sign up to or use the Services.
  We collect this information directly from you, or from other sources and third parties such as our partners or your employer, organizers of events or promotions that we were both involved in, and through the use of tools and channels commonly used for connecting between companies and individual professionals to explore connection opportunities.

• Communications: Personal data contained in any forms and inquiries that you may submit to us, including support requests, interactions through social media channels, instant messaging apps; registrations to events and photographs taken at events that we host, organize or sponsor; participation in our online and offline communities and activities; surveys, feedback and testimonials received; expressed, presumed or identified needs, preferences, attributes and insights relevant to our potential or existing engagement; and sensory information including phone call and video conference recordings (e.g., with support teams), as well as written correspondence, screen recordings, screenshots, documentation and related information that may be automatically recorded, tracked, transcribed and analyzed, for purposes including analytics, quality control and improvements, training, and record-keeping purposes.

For the purposes of the California Consumer Privacy Act (“CCPA”), specifically in the last twelve (12) months, we have collected the following categories of Personal Information: Identifiers; Professional or Employment-Related Information; Internet or other Electronic Network Activity Information; Customer Records Information; Geolocation Information; Inferences; and Audio, electronic, visual, thermal, olfactory information. We do not use or disclose sensitive personal information as defined in the CCPA.

2. Data Uses and Legal Bases

We use personal data for the following purposes and in reliance on the lawful bases noted in the chart below:

If you reside or are using the Services in a territory governed by privacy laws under which “consent” is the only or most appropriate lawful basis for the processing of personal data (in general, or specifically with respect to the types of personal data you expect or elect to submit or have processed via the Services), your acceptance of this Privacy Policy will be deemed your consent to the processing of your personal data for all purposes detailed in this Privacy Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us.

3. Data Location

We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States of America, Israel, the European Union (“EU”), the United Kingdom (“UK”) and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law.

Local privacy laws may be different in your location. For such transfers across territories, the monday.com Foundation adopts appropriate safeguards to protect your personal data, your fundamental rights and freedoms, and the exercise of your rights in accordance with applicable laws.

If we transfer personal data originating from the European Economic Area (EEA), the UK, or Switzerland to countries that provide an adequate level of data protection based on adequacy decisions published by the European Commission (and associated), the UK or Switzerland (as relevant), we rely on such adequacy findings regarding the level of data protection offered by the recipient country.

‍
To the extent we transfer personal data originating from the EEA, the UK or Switzerland to countries that have not been recognized as offering an adequate level of data protection by the relevant competent authority, we and the relevant data exporters and importers rely on appropriate trans-border data transfer mechanisms as established under applicable law, such as the standard contractual clauses adopted by the EU (available here) and the UK (available here).

4. Data Retention

We retain your personal data for as long as it is reasonably necessary to maintain and expand our relationship and provide you with our Services and offerings; to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (e.g., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise), all in accordance with our data retention policy. Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your personal data for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you.
‍

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements.
‍

If you have any questions about our data retention policy, please contact us as indicated in Section 12 below.

5. Data Disclosure

We may disclose your personal data to certain third parties as described below:

• Service Providers: We engage with third-party companies and individuals to perform services complementary to our own. Such service providers provide us with support, including hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection and prevention services, web and mobile analytics, data enrichment, e-mail and/or SMS distribution and monitoring services, call, session or activity recording and analysis services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content providers, e-mail, voicemails, support and customer relation management systems, and our legal, financial and compliance advisors (collectively, “Service Providers”). These Service Providers may have access to your personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use such data for such limited purposes as determined in our agreements with them.
• Legal Compliance: In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services.
• Event Sponsors: If you attend an event or webinar organized by us, or download or access an asset on our Sites related to such an event, webinar or other activity involving third-party sponsors or presenters, we may disclose your personal data to them. If required by applicable law, you may consent to such disclosure via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your personal data will be subject to the sponsor’s privacy statements. If you do not wish your personal data to be disclosed, you may choose to not opt-in via event/webinar registration or elect to not have your badge scanned, or you can opt out in accordance with Section ‎9 below.
• Sharing your Feedback or Recommendations: If you submit a public review or feedback, note that we may (at our discretion) store and present your review via our Services.
• Protecting Rights and Safety: We may disclose personal data with others if we believe in good faith that this will help protect the rights, property, or personal safety of the monday.com Foundation, you, or any members of the general public.
• Change in controllership: We may disclose personal data in case we undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be disclosed or transferred to the parties involved in such an event. If we believe that such a change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via e-mail or a prominent notice on our Services.

For the avoidance of doubt, we may disclose your data in additional situations, pursuant to your explicit approval, if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, disclose or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval.
‍

For the purpose of the CCPA, in the last 12 months, we have disclosed Identifiers; Internet or other electronic network activity information; Geolocation Data; Commercial Information; Customer Record Information; Audio, Electronic or Similar Information; and Inferences to the third parties listed above.

6. Cookies and Tracking Technologies

Cookies: As is true of most websites, our Sites and Services utilize “cookies”, anonymous identifiers, pixels, container tags, and other technologies to provide our Services and ensure that they perform properly, to analyze our performance and marketing activities, and to personalize your experience. Such cookies and similar files or tags may also be temporarily placed on your device. Certain cookies and other technologies serve to recall personal data, such as an IP address, previously indicated by your device when visiting our Sites or using the Services. Under some data protection laws, like the CCPA and other US state privacy laws, our disclosure of this data to third parties for targeted advertising may be considered a “sale” or “share” of personal information. To learn more about our practices concerning cookies and tracking, and how to exercise your opt-out rights, please see our Cookie Policy. You can manage your cookie preferences and opt out of the sale or share (for targeted advertising) of your data via our cookie banner, which you can reopen anytime by clicking the “Your Privacy Choices” link or the toggle icon in the footer of each webpage within our Services.

Google Analytics: We use Google Analytics to collect information about the use of our Sites and Services. This tool helps us understand Users’ behavior on our Services, including by tracking page content, and click/touch movements, scrolls and keystroke activities. Google Analytics also collects information such as how often you visit the Services, which pages you visited when doing so, and which other sites you used prior to coming to our Sites. We do not merge the information collected through the use of Google Analytics with personally identifiable information. Google’s ability to use and share information collected by Google Analytics about your visits to and use of the Services is restricted by the Google Analytics Terms of Service and the Google Privacy Policy. You can learn more about how Google collects and processes data specifically in connection with Google Analytics here. Further information about your option to opt out of these analytics services is available here.

7. Communications

We may engage in service and promotional communications, through e-mail, phone, SMS and notifications.

Service Communications: We may contact you with information regarding our Services. For example, we may send you notifications (through any means available to us) of changes or updates to our Services or legal terms, etc.

Promotional Communications: We may also notify you about new Services, additional offerings, events, special opportunities or any other information of a promotional nature we think you will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, mobile or e-mail), through the Services, or through our marketing campaigns on any other sites or platforms.If you do not wish to receive promotional communications, you may notify us (see below contact details), or by following the “unsubscribe”, “stop”, “opt-out” or “change e-mail preferences” instructions contained in the promotional communications you receive. Note that even if you opt out from promotional communications, we may still be able to send you service communications.

8. Data Security

To protect your personal data held with us, we use industry-standard physical, procedural and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described in Section 5 above.

9. Data Subject Rights

Individuals have rights concerning their personal data under applicable law, including the UK General Data Protection Regulation (GDPR), the CCPA and Israel’s Protection of Privacy Law (PPL).
‍

Such rights may include, to the extent applicable to you according to the laws that apply to you, the right: (i) to know/request access to personal data (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third-parties to whom we have disclosed personal data), (ii)  to request rectification or erasure of personal data held with the monday.com Foundation, (iii) to restrict or object to such personal data’s processing (including the right to direct us not to sell your personal data for targeted advertising), (iv)  to port such personal data, or (v) to equal services and prices. To exercise any of these rights you may have, please contact us. You may also have the right to lodge a complaint with your local data protection authority.
‍

To the extent applicable to you, you may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf.  The authorized agent may submit a request to exercise these rights by emailing us.

Please note that when you ask us to exercise any of your rights under this policy or applicable law, we may need to ask you to provide certain credentials to make sure that you are who you claim you are (to avoid disclosure to you of personal data related to others) and to provide further information to better understand the nature and scope of data for which you request access. Such additional data will then be retained by us for legal purposes (e.g. as proof of the identity of the person submitting the request, or proof of request fulfillment). We may redact from the data that we will make available to you, any personal data or confidential information related to others.

10. Data Controller/Processor

Certain data protection laws and regulations, such as the UK GDPR, CCPA and PPL, typically distinguish between two main roles for parties processing personal data: the “data controller” (or under the CCPA, “business” and under the PPL, “database controller”), who determines the purposes and means of processing; and the “data processor” (or under the CCPA, “service provider” and under the PPL, “database holder”), who processes the data on behalf of the data controller.
‍

The monday.com Foundation is the “data controller” of personal data of mondayERT Participants & Partners, monday.com Foundation Community members and Visitors. In such situations, our Service Providers processing such data on our behalf will assume the role of “data processor”.
‍

Where we connect you with monday.com for use of the monday.com services, for example through mondayERT, your engagement with monday.com will be governed by the monday.com Privacy Policy and any relevant agreements with monday.com (including any applicable Data Processing Agreemåent).

11. Additional Notices

Updates and Amendments: We may update and amend this Privacy Policy from time to time by posting an amended version on our Sites/Services. The amended version will be effective as of the date it is published. We will provide prior notice if we believe any substantial changes are involved via any of the communication means available to us or via the Sites/Services. After such notice period, all amendments shall be deemed accepted by you.
‍

Opt out of Sale/Sharing for Targeted Advertising:Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information with third parties through cookies may be considered a “sale” or “sharing” of personal information for targeted advertising. We do so in pursuit of the business and commercial purposes described in Section 2 above.
‍

For the purposes of the CCPA, in the last 12 months we have "sold" or "shared" Internet or Other Electronic Network Activity Information, Geolocation Data, and Commercial Information with our analytics and advertising partners and service providers.
‍

You may opt out of all cookies that may result in a “sale” and/or “sharing” of your personal information in the following ways:

• Click the “Do not sell or share my personal data” button in the cookie banner (depending on your location), or in the “cookie settings” link on the website footer, then click the “Save settings” button.
• ‍Set the Global Privacy Control (GPC) for each participating browser system that you use to opt out of the use of third-party Advertisement Analytics or other cookies (instructions on how to download and use GPC are available here).

If you have any questions or would like to exercise your rights under the CCPA, you can contact us.
‍

External Links: While our Sites/Services may contain links to other websites or services, we are not responsible for their privacy practices. We encourage you to pay attention when you leave our Services for the website or application of such third parties, and to read the privacy policies of each website and service you visit. This Privacy Policy applies only to our Services.
‍

Children: Our Services are not designed to attract children who are underage according to data protection laws in their respective jurisdictions. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so, and we request that anyone underage refrain from providing their personal data to us via our website. If you believe that we might have any such data, please contact us. If we are made aware that a person who is underage according to the law applicable to them has accessed our Sites or other Services, we will attempt to prohibit and block such use and will make all necessary efforts to delete any personal data stored with us with regard to that child, except where retention is required for legal purposes.
‍

For the purposes of the CCPA, monday.com Foundation does not knowingly sell or share the personal information of individuals under the age of 16.

‍Database Controller: For the purposes of Israel’s Protection of Privacy Law (“PPL”), the monday.com Foundation Ltd. serves as the “Database Controller” for personal data processed in connection with this Privacy Policy that originates from Israel or that is otherwise subject to the PPL, and can be contacted in the contact as outlined in section 12 below.

12. Contact Us

If you have any comments or questions regarding our Privacy Policy, or if you have any concerns regarding your personal data held with us, please contact us via this FORM or send an email to:  mondayfoundation@monday.com.

‍

Last updated: 06 August 2026