Privacy policy — LastPass

Cited by

Facts read from this source

• Controller entity Report an error

  “LastPass US LP is based in the United States of America, with affiliates around the world.”

• Eea controller Report an error

  “LastPass Ireland Limited (Ella House, 41.2 Merrion Square, Dublin 2 D02 NP96, Ireland. Data protection officer: privacy@lastpass.com) is the controller for data collected in connection with your use of the Services if you live in the EEA or Switzerland or visits to our offices in the EEA.”

• UK controller Report an error

  “LastPass UK Ltd (5 New Street Square, London EC4A 3TW, United Kingdom. Data protection officer: privacy@lastpass.com) is the controller for data collected in connection with your use of the Services if you live in the UK or visits to our offices in the UK.”

• Joint controllers Report an error

  “For purposes of providing the Services, LastPass Ireland Limited, LastPass UK Ltd, and LastPass US LP (contact information in Section 11) are responsible as joint controllers.”

• Zero knowledge encryption Report an error

  “This means that vault data is encrypted locally at the device level before syncing to LastPass servers in an already encrypted state for safe storage – users can only decrypt their vault data using their own master password.”

• Master password exception SSO Report an error

  “Except for those LastPass Business accounts which utilize alternative authentication methods (e.g., Single Sign On or “SSO”) to access LastPass, users must create a “Master Password,””

• Dark web monitoring Report an error

  “This data from third-party sources includes identity breach monitoring data (e.g., for dark web monitoring)”

• Sms recovery Report an error

  “You may provide us with your mobile phone number if you set up two-factor authentication and/or opt-in to our SMS account recovery feature.”

• Dpf certified Report an error

  “LastPass complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce.”

• Apec cbpr Report an error

  “LastPass participates in the APEC Cross Border Privacy Rules System (“CBPR”) and Privacy Recognition for Processors (“PRP”) system”

• Security assessment Report an error

  “LastPass has been assessed by, and received validation from, independent third-party auditors against recognized security standards and controls.”

• Transfer mechanisms Report an error

  “LastPass utilizes, as applicable and required, lawful data transfer mechanisms, such as the Data Privacy Framework (see “Data Privacy Framework Notice” below), Standard Contractual Clauses (inclusive of any variations recognized in other regions of the world), or other appropriate legal mechanisms to safeguard personal data transfers from the European Economic Area, United Kingdom, or Switzerland.”

• No sale Report an error

  “LastPass does not sell your personal data – including any vault data.”

• Vault access Report an error

  “no one at LastPass has access to the encrypted data stored in your vault, except you.”

• Retention Report an error

  “We keep your personal data no longer than is needed for the business purposes for which it was collected (as outlined in Section 3) or as necessary to comply with our own legal and regulatory obligations.”

• Rights Report an error

  “Your rights may include the right to: Access to your personal data and right to know more about how we process your personal data; Export or transfer your personal data”

• Rights response time Report an error

  “We strive to respond to all legitimate privacy requests within one month of receipt, but in any event within the time frames required under applicable law.”

• Privacy contact Report an error

  “you may contact the LastPass Privacy Team or Data Protection Officer by emailing us at privacy@lastpass.com or write to us via postal mail at: Attn: Data Protection Officer, c/o LastPass Legal, LastPass, 125 High Street, Suite 220, Boston, MA 02210.”

• Dispute resolution Report an error

  “LastPass commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to https://feedback-form.truste.com/watchdog/request, an alternative dispute resolution provider based in the United States. The services of TRUSTe are provided at no cost to you.”

• Automated decision making Report an error

  “please note that automated decision-making does not occur on our websites or in our Services”

• Trial no card Report an error

  “No credit card required for the 14-day trial.”

• Subprocessor requests Report an error

  “Request information about entities processing your personal data, including Sub-Processors;”

• Childrens privacy Report an error

  “LastPass’ webpages and Services are not intended for children. If you inform us or we otherwise become aware that we have unintentionally received personal data from a minor without a parent’s or guardian’s consent, we will delete this data from our records.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The CISO Encryption model & independent audits
• The CISO Sharing, roles & recovery
• The CISO SSO, directory sync & provisioning
• The CISO Hosting choice, offline access & export
• The CISO European sovereignty
• The CISO Hosting choice, offline access & export
• The CISO European sovereignty
• The Compliance Auditor Encryption model & independent audits
• The Compliance Auditor Hosting choice, offline access & export
• The Compliance Auditor European sovereignty
• The Compliance Auditor European sovereignty
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer Sharing, roles & recovery
• The DevOps Engineer Hosting choice, offline access & export
• The DevOps Engineer European sovereignty
• The DevOps Engineer Encryption model & independent audits
• The DevOps Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer Hosting choice, offline access & export
• The Identity Engineer European sovereignty
• The Identity Engineer Encryption model & independent audits
• The Identity Engineer SSO, directory sync & provisioning
• The Identity Engineer Hosting choice, offline access & export
• The Identity Engineer European sovereignty
• The Skeptic Encryption model & independent audits
• The Skeptic Sharing, roles & recovery
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The Skeptic SSO, directory sync & provisioning
• The Skeptic Hosting choice, offline access & export
• The Skeptic European sovereignty
• The SME Owner Encryption model & independent audits
• The SME Owner Sharing, roles & recovery
• The SME Owner SSO, directory sync & provisioning
• The SME Owner Hosting choice, offline access & export
• The SME Owner European sovereignty
• The SME Owner SSO, directory sync & provisioning
• The SME Owner Hosting choice, offline access & export
• The SME Owner European sovereignty