www.ironmountain.com Open in urlscan Pro
40.75.110.40  Public Scan

Form analysis
2 forms found in the DOM

<form class="aa-Form" action="" novalidate="" role="search">
  <div class="aa-InputWrapperPrefix"><label class="aa-Label" for="autocomplete-0-input" id="autocomplete-0-label"><button class="aa-SubmitButton" type="submit" title="Submit"><svg class="aa-SubmitIcon" viewBox="0 0 24 24" width="20" height="20"
          fill="currentColor">
          <path
            d="M16.041 15.856c-0.034 0.026-0.067 0.055-0.099 0.087s-0.060 0.064-0.087 0.099c-1.258 1.213-2.969 1.958-4.855 1.958-1.933 0-3.682-0.782-4.95-2.050s-2.050-3.017-2.050-4.95 0.782-3.682 2.050-4.95 3.017-2.050 4.95-2.050 3.682 0.782 4.95 2.050 2.050 3.017 2.050 4.95c0 1.886-0.745 3.597-1.959 4.856zM21.707 20.293l-3.675-3.675c1.231-1.54 1.968-3.493 1.968-5.618 0-2.485-1.008-4.736-2.636-6.364s-3.879-2.636-6.364-2.636-4.736 1.008-6.364 2.636-2.636 3.879-2.636 6.364 1.008 4.736 2.636 6.364 3.879 2.636 6.364 2.636c2.125 0 4.078-0.737 5.618-1.968l3.675 3.675c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414z">
          </path>
        </svg></button></label>
    <div class="aa-LoadingIndicator" hidden=""><svg class="aa-LoadingIcon" viewBox="0 0 100 100" width="20" height="20">
        <circle cx="50" cy="50" fill="none" r="35" stroke="currentColor" stroke-dasharray="164.93361431346415 56.97787143782138" stroke-width="6">
          <animateTransform attributeName="transform" type="rotate" repeatCount="indefinite" dur="1s" values="0 50 50;90 50 50;180 50 50;360 50 50" keyTimes="0;0.40;0.65;1"></animateTransform>
        </circle>
      </svg></div>
  </div>
  <div class="aa-InputWrapper"><input class="aa-Input" aria-autocomplete="both" aria-labelledby="autocomplete-0-label" id="autocomplete-0-input" autocomplete="off" autocorrect="off" autocapitalize="off" enterkeyhint="search" spellcheck="false"
      placeholder="I'm looking for..." maxlength="512" type="search"></div>
  <div class="aa-InputWrapperSuffix"><button class="aa-ClearButton" type="reset" title="Clear" hidden=""><svg class="aa-ClearIcon" viewBox="0 0 24 24" width="18" height="18" fill="currentColor">
        <path
          d="M5.293 6.707l5.293 5.293-5.293 5.293c-0.391 0.391-0.391 1.024 0 1.414s1.024 0.391 1.414 0l5.293-5.293 5.293 5.293c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414l-5.293-5.293 5.293-5.293c0.391-0.391 0.391-1.024 0-1.414s-1.024-0.391-1.414 0l-5.293 5.293-5.293-5.293c-0.391-0.391-1.024-0.391-1.414 0s-0.391 1.024 0 1.414z">
        </path>
      </svg></button></div>
</form>

POST

<form id="fileUploadForm" enctype="multipart/form-data" method="post" target="fileUploadIframe"><input type="file" id="fileSelector" name="file" style="display: none;"><input name="filename" type="hidden"></form>

Text Content

United States
Contact Us
Call us: 800 899 4766
Login | Account
 * ITRenew Client Portal
 * Iron Mountain Connect
 * Partner Connect
 * SecureSync
 * Pay My Bill Online
 * Secure ITAD Portal
 * Data Center Client Portal
 * Data Center PartnerConnect
 * ReQuest Web
 * Express Dashboard
 * Regency Client Login

Shop Services Online
 * Bulk Paper Shredding
 * Recurring Paper Shredding
 * Document Scanning
 * Document Storage
 * Box and Supplies
 * Office Electronics Recycling
 * Pallet Storage
 * Policy Center
 * View All Offerings


WHAT WE DO


WHO WE ARE


RESOURCES


SUPPORT

Free Quote
 * Homepage
   
 * Privacy Notice
   


PRIVACY NOTICE

Last updated: October 2023

Privacy statement


IRON MOUNTAIN COMPANIES AS DATA CONTROLLERS

Iron Mountain Information Management, LLC in the U.S.A. and its subsidiaries
(“Iron Mountain” or “We”) value your privacy. This Privacy Notice explains how
Iron Mountain collects, uses, and shares information that identifies its
customers, prospect customers, vendors, business partners and website visitors
(“Personal Data”), when We act as a data controller. A data controller is an
entity that decides why and how Personal Data is used (processed).


IRON MOUNTAIN’S GLOBAL STANDARDS AND LOCAL RULES

This Privacy Notice sets forth our global privacy standards.

Apart from Iron Mountain’s global standards, We adhere to all relevant and
applicable local privacy laws. Thus, depending on the region where our business
is located, we comply, among others, with the General Data Protection Regulation
2016/679 (EU GDPR), and the data protection laws applicable in the EEA countries
where We operate, the UK General Data Protection Regulation (UK GDPR) and the UK
Data Protection Act 2018; the California Consumer Privacy Act 2018 (CCPA) 2018,
Brazil General Data Protection Law 2020 (LGPD); China Personal Information
Protection Law 2021 (PIPL), and the Singapore Personal Data Protection Act 2012.


COUNTRY SUPPLEMENTS AND LOCAL PRIVACY NOTICES

Certain Iron Mountain’s subsidiaries may be obliged to adhere to such local data
protection laws that require the disclosure of their own country specific
privacy statements (that are usually provided to you by our local Iron Mountain
subsidiary at the time of Personal Data collection). You can access the country
specific supplements here:

• CCPA/California Consumer Privacy Act

• China

For the translated version of this Privacy Notice, please see relevant country
websites. For instance, the German version of this document is accessible at our
German language websites.

How we use your personal data


LEGAL GROUNDS FOR PROCESSING

We conduct our business with privacy and data protection in mind. We ensure that
processing has a legitimate basis and is compliant with applicable privacy law.
In most cases We collect and use your Personal Data based on the following legal
grounds:

• Contract performance: when processing is necessary to conclude and perform
contracts with our customers, vendors, business partners, or other stakeholders;

• Consent: when We have obtained your consent for processing your Personal Data
(e.g., for sending marketing communications about our products or services or
tracking your activities on our websites via cookies to improve your customer
experiences);

• Legitimate interest: when We wish to fulfill our legitimate business purposes
(e.g., for displaying website content relevant to your geographical location or
otherwise customize). We rely on legitimate interest only if this is
proportionate and guarantees the good balance between our business goals and
your privacy rights;

•Compliance with applicable laws: when processing is necessary to comply with
the relevant legal or regulatory obligations that We have (e.g., when We need to
share Personal Data with the public and tax authorities).

What type of personal data we collect and use


COLLECTION AND USE OF PERSONAL DATA

Depending on your relationship with Iron Mountain and subject to the applicable
laws and regulations, We may collect and use your Personal Data as follows:

• Business Contact Details (customers, prospect customers, vendors): business
contact information (e.g., business contact, professional address, telephone
number); personal data of customers’ and vendors’ representatives (e.g., name,
contact details); structured data (e.g., proprietary data); technical
information (e.g., customer portal, user IDs and passwords, access logs),
processed for the following main purposes: contract negotiation and execution,
regulatory compliance, business developments and relations, claim management,
administration, accounting, improving our services and providing them to
customers.

•Audit, Investigations, Due Diligence Personal Data (customers, vendors): name,
contact details (e.g., address, phone number, email address), title/function,
tax number, bank account information as well as other information relating to
the vendor or customer relationship, processed for the following main purposes:
audit, investigation, operational security, regulatory compliance, due diligence
screening, claims management, litigation purpose.

• Online Collection of Personal Data (website visitors): information collected
via Iron Mountain websites such as contact details, login credentials, online
comments, and feedback from online forums and surveys etc., processed for the
following main purposes: enabling efficient use of our websites, optimising the
functionality of such websites, engaging with customers/prospects and suppliers
in online forums, conducting and evaluating customer satisfaction.

•Technology enabled Collection of Personal Data (website visitors): Iron
Mountain websites use various cookies and similar technologies. A cookie is a
small text file placed onto your device, by a website that you visit. These
files allow Iron Mountain’s websites to improve user experience by delivering
content tailored to users’ interests and enabling other features. You have a
variety of tools to control the data collected by cookies and similar
technologies. Where required, Iron Mountain uses cookies only upon your consent.
For instance, cookies that provide you with customized content. Iron Mountain
websites allow you to control some cookies through their cookie banners or
browser settings.

• Children Personal Data: We are concerned about the safety of children when
they use the Internet and will never knowingly collect Personal Data from minors
(children under 16 years of age, or any other age defined under applicable law).

•Direct Marketing (customers, prospect customer): We might use your Business
contact details (e.g., e-mail) to provide you with information about our
products and services which We believe might be of your interest. For this
purpose, We may also create a personal profile containing business-related
information on the company you work for or the interactions between us with the
aim of being able to offer you and the company you work for relevant information
and suitable offers for our services and products and to improve our personal
communication with you. Iron Mountain will only send you such communications
(e.g., by email and/or contact you by telephone) if you gave us your prior
consent to receive it (“opt in consent”) or as permitted until you have opted
out of receiving such communications. Withdrawal of consent or opting out for
marketing communication: If you are receiving marketing communications but would
no longer like to, you may withdraw your consent or opt out at any time here.

How we collect your personal data


WE COLLECT PERSONAL DATA FROM THE FOLLOWING SOURCES:

• customers and prospect customers (legal entities and individuals)

• customers’ representatives and proxies (e.g., individuals representing the
company for the purpose of contract management)

• Iron Mountain websites visitors

• third parties (Iron Mountain’s vendors)

• Iron Mountain companies, affiliates

• public enforcement authorities, including tax authorities, courts,
administrative authorities etc.

• publicly available sources (professional social media; official registers
etc.), to the extent allowed by applicable law and regulations.


COLLECTING PERSONAL DATA AS A DATA PROCESSOR

We process Personal Data of our customers as a data processor without reviewing
the content or origin of such Personal Data. We may collect, store and process
such Personal Data solely on our customers’ behalf and at their direction. Our
customers who use our services in this way are data controllers and are
responsible for obtaining any consents, permissions and for providing privacy
notice required for the collection and use of such information.

 

How we share your personal data

We may share your Personal Data internally (within the Iron Mountain company
group) and externally (to third parties such as our suppliers, advisors,
business partners for Iron Mountain). Subject to applicable law and regulations,
We may share and/or disclose your Personal Data in a way explained in this
Section.

Internal sharing: Iron Mountain has its headquarters in Boston, Massachusetts
(U.S.A), but operates worldwide. Thus, to achieve business goals – with privacy
in mind – We may share your Personal Data with other Iron Mountain subsidiaries
in accordance with, and as described by, this Notice.

External sharing: We may also share your Personal Data with third parties,
including:

• Iron Mountain suppliers: providing services to Iron Mountain may require
processing of your Personal Data (e.g., providing customer relationship
management tool or general IT support, distributing marketing materials, etc.).
In this case, these entities may receive and process your Personal Data only
under Iron Mountain’s instructions and for the purposes of carrying out services
for us.

• Other third party for sale, merger, transfer of a business or division
purposes: this also includes due diligence screening purposes which may also
require the disclosure of Personal Data to Iron Mountain’s consultants or
financial auditors.

• Public authorities: We may also have a legal obligation to disclose your
Personal Data, even without your permission. The purposes of such disclosures
include among others: (a) responding to lawful requests of public authorities,
regulators, and law enforcement authorities and (b) protecting Iron Mountain’s
rights and properties.


IRON MOUNTAIN DATA SHARING STANDARDS

We will not share your Personal Data with third parties without your consent,
unless to: (a) fulfil a legitimate business purpose of Iron Mountain (e.g., to
use a service delivered by a supplier); (b) respond to duly authorised requests
of public authorities; (c) comply with applicable laws and regulations; (d)
enforce/protect the rights and properties of Iron Mountain; or; (e) protect the
rights of our employees, and other individuals using Iron Mountain property when
allowed and in each case in accordance with applicable law. We does not and will
not sell your personal data.

How we transfer your personal data internationally

Your Personal Data may be transferred to or accessed by other Iron Mountain
companies and subsidiaries and third parties globally. The recipients may be
located in countries that do not provide an adequate level of protection to your
Personal Data from the perspective of the origin country.

We ensure that Personal Data, subject to the transfer, is adequately protected
as required by the applicable data protection laws of the origin country. While
transferring your Personal Data, We normally rely on one or more of the
following:

• Standard Contractual Clauses (“SCCs”) for international transfers of Personal
Data, as may be applicable and relevant, (e.g., transfer of EU/UK/Swiss Personal
Data to countries such as the U.S.A and India). If you would like to receive
more information about the appropriate safeguards and/or receive a copy of the
SCCs for your review, please contact us here.

• Where required by applicable law, We request your consent for transfer of your
Personal Data.

• Iron Mountain has executed an intercompany agreement on the transfer and
processing of Personal Data within its company group to enable internal transfer
of Personal Data.

• Iron Mountain complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF),
the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework
(Swiss-U.S. DPF). You may find more information here.

How long we keep your personal data

We will retain your Personal Data for as long as is reasonably necessary for the
purposes for which it was collected, as explained in this Notice. In some
circumstances We may retain your Personal Data for longer periods of time, for
instance where We are required to do so in accordance with legal, regulatory,
tax or accounting requirements. In specific circumstances We may retain your
Personal Data for longer periods of time so that we have an accurate record of
your dealings with us in the event of any complaints or challenges, or if We
reasonably believe there is a prospect of litigation relating to your Personal
Data or dealings.

Where We have obtained your Personal Data in order to provide you with marketing
information for our products and services, your Personal Data will be stored by
us as long as you do not change your mind to receive such information or, if
required by law, it will be removed earlier if you do not show any interest in
our products and services following our communications (i.e. you are inactive)
in order to avoid future contact with you for marketing purposes. We maintain a
data retention notice which we apply to records in our care. Where your Personal
Data is no longer required We either delete it by erasing electronic files and
shredding physical records or anonymise them in a way that We are no longer able
to identify you. Iron Mountain has dedicated internal policies that keep us
compliant with the retention rules.

How we secure your personal data

We always protect your Personal Data in accordance with the highest security
standards. To ensure protection of your Personal Data from loss or unauthorised
use, access, or disclosure, We always apply appropriate technical, organisation
and administrative measures. Some of the steps We take are: placing
confidentiality requirements on our staff members and service providers;
destroying or permanently anonymising Personal Data if it is no longer needed
for the purposes for which it was collected. We always check current market
standard norms (e.g., ISO norms) and stay up to date with the newest security
measures appropriate to the risk related to protection of your Personal Data.

Data subject/consumer rights: How to access and control your personal data

We respect your data subject/consumer rights and, in as provided for by
applicable privacy laws, you may exercise your right(s) to:

 1. access and obtain a copy of your Personal Data – note that We may need to
    check your identity first to avoid disclosure to any unauthorised person and
    also respect the right to privacy of other individuals when providing you
    access or copy of your Personal Data;
 2. rectify or erase your Personal Data – if data is inaccurate or incomplete;
 3. restrict the processing of your Personal Data – e.g., when you question the
    accuracy of processing, and We restrict processing only until your request
    is verified;
 4. delete or anonymise your Personal Data (under GDPR “right to be forgotten”)
    unless there are exceptions, e.g., when law allows us such processing;
 5. ensure so-called “data portability” - upon your request, Iron Mountain might
    “transfer” your Personal Data to another organisation/company if processing
    is based on your consent or the performance of a contract;
 6. object to the processing of your Personal Data - e.g., when We process your
    Personal Data based on our legitimate interest or for direct marketing
    purposes and the processing is carried out by automated means;
 7. obtain a copy of Personal Data safeguards applied for transfers outside your
    jurisdiction - e.g., the copy of SCCs;
 8. lodge a complaint with your local supervisory authority: Data Protection
    Authority, e.g., ICO in the UK;
 9. withdraw your consent for the processing of your Personal Data (however this
    does not affect the lawfulness of processing based on consent before its
    withdrawal).

Subject to legal and other permissible considerations, We will make every
reasonable effort to respond to your request as soon as possible (in any case
within the timeframe required by law) or inform you if We require further
information to fulfil your request. In some cases, your ability to access or
control your Personal Data will be limited, as required, or permitted by
applicable law. We may ask you for additional information to verify your
identity and for security purposes, before disclosing the requested Personal
Data to you. We also reserve the right to charge a fee where permitted by law,
for instance if your request is manifestly unfounded or excessive.

How to contact us

If you have a privacy concern, complaint or question to Iron Mountain please
contact us:

Global Privacy & Compliance
Global Privacy Officer
EEA/UK Group Data Protection Officer
Contact us here

You may find both the name of our local subsidiary and contact details here (for
Crozier entities here) by selecting region and country. We will aim to ensure
that your complaint is resolved in a timely and appropriate manner and treat
your requests and complaints confidentially. Our representative will contact you
within a reasonable time after receipt of your complaint observing whether there
are any local rules that indicate a deadline to resolve your request.

Changes to this privacy notice

We will publish a revised version of this Privacy Notice any time when we update
it with the revision date set out in the document. The privacy notice/policy
link of each Iron Mountain website will easily direct you to that newest version
of this Privacy Notice.


CONTACT US


CONTACT US

Fill out this form and an Iron Mountain specialist will contact you within one
business day.
Get a quote


LOGIN AND BILL PAY

Log in to your account or learn how to create one.
Get started


SUPPORT CENTER

Our Customer Support Center can help provide you with the quickest answers to
your questions.
Get support


CALL SALES

Connect with one of our knowledgeable representatives to address your specific
solution needs.
800 - 899 - 4766
Follow:
 * What we do
   
   * Asset Lifecycle Management
   * Data Centers
   * Data and IT Security
   * Digital Transformation
   * Sustainability Solutions
   * Workplace Evolution
   * View All Services
 * Industry solutions
   
   * Entertainment
   * Financial Services
   * Fine Arts
   * Library and Archives
   * Public Sector
   * Healthcare
   * Small Business Solutions
 * Who we are
   
   * About Us
   * Careers
   * Certifications and Awards
   * Investors
   * Leadership Team
   * News and Stories
   * Partners
   * Sustainability
 * Contact us
   
   * Customer Support
   * Contact Sales
   * Portal Login and Bill Pay
   * Invoice Information
 * Resources
   
   * Blogs and Articles
   * Customer Success Stories
   * Infographics
   * Solution Guides
   * Videos and Webinars
   * Whitepapers
   * View all resources




Website terms and conditionsPrivacy noticeYour U.S. state privacy rights
© 2024 Iron Mountain, Inc.



Need help? ×

Hi! I'm an automated assistant to help you get the information you need. Would
you like to start a live chat with our experts?

Start Chat Close

Live chat:Chat with an Expert