New Relic

[Services Privacy Notice] states New Relic may 'aggregate or de-identify Customer Data across multiple accounts and use this data to improve or enhance engagement of our Services,' but does not explicitly state whether de-identified data is used for AI model training. The language is vague on AI training specifically, and no explicit opt-out or prohibition is stated.

“[Services Privacy Notice] 'aggregate or de-identify Customer Data across multiple accounts and use this data to improve or enhance engagement of our Services'”

[Services Privacy Notice] explicitly states 'Customer is the data controller/business owner of the Customer Data. New Relic is the processor/service provider of the Customer Data.' This establishes that the customer retains ownership and control. The license is limited to providing the service under documented instructions.

“[Services Privacy Notice] 'Customer is the data controller/business owner of the Customer Data. New Relic is the processor/service provider of the Customer Data.'”

[Services Privacy Notice] states sub-processors are 'subject to the same data protection and security obligations' and provides 21 days' notice with opt-out rights for new core sub-processors. However, the document does not explicitly list all sub-processors or provide a published sub-processor list, and sharing with 'affiliates' and 'partners' is mentioned in the General Privacy Notice without full clarity on scope.

“[Services Privacy Notice] 'sub-processors shall be subject to the same data protection and security obligations as New Relic under the Customer Agreement or applicable executed Data Protection Addendum'”

[Services Privacy Notice] states 'we retain Personal Data in accordance with the retention period in the Customer Agreement' but does not specify default retention periods in the document itself. The General Privacy Notice states data is retained 'where we have an ongoing legitimate business need' which is vague. No explicit automatic deletion on account termination is stated.

“[Services Privacy Notice] 'we retain Personal Data in accordance with the retention period in the Customer Agreement'”

[Services Privacy Notice] clearly establishes that 'Customer is the data controller/business owner of the Customer Data' and New Relic acts only as a processor. This means the customer retains all IP ownership of data submitted and generated within the service.

“[Services Privacy Notice] 'Customer is the data controller/business owner of the Customer Data. New Relic is the processor/service provider of the Customer Data.'”

[Services Privacy Notice] explicitly states 'New Relic has obtained certifications from independent, third-party auditing organizations such as ISO27001 and HITRUST' and references compliance with 'NIST 800-53 standard.' The General Privacy Notice confirms compliance with EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF.

“[Services Privacy Notice] 'New Relic has obtained certifications from independent, third-party auditing organizations such as ISO27001 and HITRUST and provides security in accordance with industry accepted standards'”