This Privacy Disclosure covers VMware Workspace ONE® Unified Endpoint Management™ (UEM), VMware Workspace ONE® Access™, VMware Workspace ONE® Intelligence™ as well as the additional VMware Workspace ONE components described below (collectively, the “Software”). The purpose of this Privacy Disclosure is to inform customers who purchase the Software (“Customers”) and those individuals whose devices are being managed by the Software (“Users”) regarding the types of information collected by the Software about Users and their devices.
Users should be aware that the data collected by the Software depends on how the Customer configures the Software. Users should review the Customer’s privacy policies or notices. Additionally, VMware and its service providers may collect data when the Software is used, as well as Customer relationship data. VMware uses this data in accordance with VMware’s Privacy Notice and VMware’s End User Terms and Conditions. The Customer is responsible for providing any necessary notices to its Users, and obtaining any legally required authorizations or consents from Users regarding use of the Software.
This Privacy Disclosure may be updated from time to time as new features and functionality are added. We encourage Customers and Users to periodically review this page. VMware is constantly updating and improving the Software to include new features and functionality. It is the responsibility of the Customer to ensure it uses the Software in accordance with its internal policies and legal requirements, including providing any required notice to Users and obtaining any required consents.
Below sections provide details of these components that are part of the Software:
This section covers VMware’s unified endpoint management software, Workspace ONE UEM, including the related VMware mobile applications.
a. Overview of the Workspace ONE UEM
Workspace ONE UEM (“UEM”) enables Customers to protect the confidentiality, security and integrity of Customer systems and information that are accessed by Users from corporate-owned and User-owned devices. UEM provides the Customer with controls which enable them to manage the access and security of its User’s devices. UEM consists of a Customer-specific console, which enables the Customer to manage its Users’ devices (“Console”) and software that is installed on a User’s device, which (i) facilitates communication between the User’s device and the Console, as well as other third-party endpoints (e.g. Apple or Google API) depending on Customer’s configuration, and (ii) provides the User with various productivity applications (i.e. an email client, a web browser, etc.). The specific features available to a Customer or a Customer’s Users will depend on the specific version/bundle purchased, how the Customer configures UEM, and which devices/platforms (i.e., iOS, Android, Windows, etc.) and mobile applications are used by the Users. The Console may be hosted by the Customer in its own IT environment (“On-Prem”) or may be hosted by VMware (“Hosted Service”).
b. Console Controls
The Console provides Customers with controls to assist them in complying with their legal obligations and internal compliance programs and requirements. The specific features available to a Customer or a Customer’s Users will depend on the specific version/bundle purchased, how the Customer configures UEM, and which devices/platforms (i.e., iOS, Android, Windows, etc.) and mobile applications are used by the Users. For example, the Customer can set password complexity, password expiration, and the timing for screen lockouts through the Console for the User’s device. Customer can also choose to enable different settings for corporate-owned devices and User-owned devices. Some of the other options available to Customers are outlined below:
i. Infrastructure. The Customer chooses whether to host the Console On-Prem or whether to have the Console hosted by VMware through the Hosted Service. If a Customer wants to maintain greater control over the environment hosting the Console, including the security thereof, the Customer can choose to host the Console On-Prem rather than having the Console hosted by VMware. The collected data is available to the Customer via the Console. If the Customer has chosen the Hosted Service, then VMware will also have access to the data collected through the Console; however, VMware only uses that data as stated in VMware’s Terms of Service and Privacy Notice.
ii. Data Collection. Using the Console, the Customer has the ability to control the types of information they collect about Users’ devices. Additionally, the Console gives the Customer the ability to have different data collection practices for corporate-dedicated, corporate-shared, and User-owned devices. For example, through the Console, the Customer can enable or disable the collection of the following data:
iii. Device Commands. Using the Console, the Customer can elect to allow/prevent certain commands and can decide whether the execution of a command requires the User’s permission:
iv. Display of User Data. The Console also contains settings that enable the Customer to decide what User data should be visible to its IT administrators via the Console. For example, the Customer can decide whether the following User data is visible to its IT administrators in the Console:
c. Collection of User and Device Data Through the UEM
User data that may be collected by UEM varies depending on the specific version/bundle purchased by the Customer, how the Customer configures UEM, and which devices/platforms (i.e., iOS, Android, Windows, etc.) and mobile applications are used by the Users. Examples of the data that may be collected by UEM are provided below.
i. General User and Device Data Collected by UEM
In connection with its core enterprise mobility management functions, UEM collects user and device data such as the following:
Identity and Authentication Information
UEM also may collect user and device data in connection with the following:
Data about Customer-Managed Applications
“Customer-Managed Applications” are Customer approved applications that are either pushed to User devices by the Customer or made available for download through the Workspace ONE Intelligent Hub™ app (formerly the AirWatch Agent®), Workspace ONE App Catalog™, or Customer application catalogues. These mobile applications may be public applications or internally-created applications. Information collected in connection with Customer-Managed Applications may include:
Data about Personal Applications: “Personal Applications” are the applications Users purchase or download from a public app store (e.g. the Apple App Store, the Google Play Store) to their devices. They are not automatically pushed to the User’s devices by Customer and are not managed via UEM. Depending on how the Customer has configured UEM, UEM may collect limited details about Personal Applications to assist the Customer in knowing/verifying that its Users do not download Personal Applications which may pose a security threat. UEM does not collect or have access to any data inside any Personal Applications. The information collected about Personal Applications may include:
File Manager Access: File manager access is functionality that allows read only access to a device’s internal and external storage. Certain mobile applications (such as Workspace ONE® Content, formerly known as VMware Content Locker) may request file manager access from a User so that data may be synced between the User’s device and the Customer’s systems, files could be attached to emails that the User wants to send, etc. When enabled, UEM may collect the contents of the device storage, including the SD card and locally stored files. Depending on how the Customer has configured UEM, certain applications like Workspace ONE Assist may have read and write access to the device file system based on the platform type and the permissions granted by the User.
Telecom and Network Information: UEM may collect certain telecom data, such as carrier information, roaming status, and networks being used. This information helps the Customer know how the device is connected, to communicate with the device, and to enforce any restrictions implemented by Customer in its use of UEM, such as preventing large applications from automatically being pushed to a device that is roaming. Depending on how the Customer has configured UEM, this telecom and network information may include the following:
Communication Data: The Customer may configure UEM to collect usage information, such as the number of calls and text messages sent or received. This information may assist the Customer in managing SMS limits on the Customer’s cellular plan. UEM does not collect or have access to the contents of text messages, phone calls, or personal email accounts. Depending on how the Customer has configured UEM, this communications data may include:
Geo-location Data: Depending on how the Customer has configured UEM, UEM may collect geo-location data. By default, it does not collect geo-location data. UEM enables the Customer to collect geo-location data as it may enable a Customer to locate lost devices or to distribute functionality and content based on certain geo-fenced locations. Depending on the operating system and platform of the device, the User may be presented with an operating system notice, asking for the User’s consent to collect geo-location data. The User can change their selection by going into their device settings and revoking the geo-location permission.
Data via Remote Access: The Customer can use UEM to establish remote control access, which allows a Customer’s IT administrators to assist in troubleshooting a User’s device issue by remotely taking control of the device. A remote-control application must be installed on the device and, depending on platform and configuration, remote control may need to be approved by the User at the time when remote control is to be taken. This functionality enables the Customer to remotely access or control the device, including the use of remote locks, screen capture, remote device reboots or remote restart (for the device or applications).
ii. Additional Data for Specialized VMware Mobile App Functionality
VMware provides various mobile applications in connection with UEM (“VMware Mobile Apps”). Some of these VMware Mobile Apps collect or share additional data in order to support their specialized functionality. For example, VMware Mobile Apps that provide VPN or internet browsing functionality (such as Boxer and Web) collect the URLs visited through those VMware Mobile Apps. The data collected and shared will vary depending on the functionality provided by the mobile application, as detailed further in the product documentation. Below are some examples of this additional data collected by specific VMware Mobile Apps:
iii. Software Development Kit (SDK). The Workspace ONE Software Development Kit (“Workspace ONE SDK”) is a code library that mobile app developers can use to build security, configurations and management capabilities into their own, non-VMware mobile applications. Apps that use the Workspace ONE SDK collect and transmit certain data back to VMware, such as identity and authentication information and device information as described above, as well as crash reporting data and analytics data as described below. When an app uses the Workspace ONE SDK to provide tunneling functionality, the app also transmits to VMware’s systems the URLs of the sites accessed using that tunneling functionality. Developers of third-party apps that use the Workspace ONE SDK also may configure the Workspace ONE SDK to collect other custom data points as they determine in their discretion. This Privacy Disclosure describes only VMware’s collection of user data from the Workspace ONE SDK; it does not address the practices of third-party developers that may incorporate the Workspace ONE SDK into their non-VMware mobile apps.
d. Device Wiping
UEM allows for two different types of device wiping:
The Customer’s IT administrator may select which device wiping feature is enabled and can perform these wipes from the Console, either manually or via an automated compliance action. The ability to perform a Full Device Wipe for a device cannot be turned on for a particular device after enrollment, meaning if the setting is off when the User enrolls the device, the Customer cannot perform a Full Device Wipe on a User’s device even if the Customer enables the Full Device Wipe setting in the Console. Depending on the Customer’s configuration, Users may be able to choose to perform an Enterprise Wipe on their devices from the self-service portal.
This section covers Workspace ONE Access (formerly VMware Identity Manager, "Access"), which enables identity and access management as part of the Workspace ONE platform. Workspace ONE Access use cases include but are not limited to single sign on, multifactor authentication, conditional access, and identity security.
a. Overview of the Workspace ONE Access
Workspace ONE Access combines the User’s identity with factors such as device and network information to make intelligence driven, conditional access decisions for applications delivered by Workspace ONE. Access acts as a broker to other identity stores and providers (such as Active Directory (AD), Active Directory Federation Services (ADFS), Azure AD, Okta and Ping Identity) that Customers may already be using to enable authentication across on-premises, SaaS, web and native applications without the need to rearchitect the identity environment.
b. Collection of User and Device Data Through the Access
i. User Data. Workspace ONE Access collects data about Users who are using the Workspace ONE platform. Typically, the data is synced from Customer’s directory with certain required attributes, as well as optional attributes that Customers can configure. Required User data that is synced with Access:
Customers can customize additional attributes to sync to Access for the purposes of policy creation or application entitlements.
ii. Authentication Data. When Users log in to the Workspace ONE platform using their username and password credentials, VMware does not store credentials in Access, but validates Users’ input by reaching out to Customer’s directory that Access has been integrated with, and validating the credentials.
In some cases, Access may cache credentials for the duration of User sessions on a User’s device to enable features such as integration with other applications like VMware Horizon® or Citrix Virtual Apps and Desktops to prevent double prompting when Users launch virtual resources. This functionality can be configured or disabled by Customer’s IT admin using Access.
Customers can also enable other authentication methods that do not involve credentials such as certificate-based authentication. To use certificate authentication, Customer IT administrators must upload root certificates and intermediate certificates to the Workspace ONE Access connector. The certificates are copied to the local certificate store on the User device. These certificates are not replicated in the Workspace ONE Access database.
iii. Logging Data. Workspace ONE Access will also generate audit logs for all User activity. For instance, what applications User is launching, time of the launch, authentication methods used, etc. These logs can be retained within Workspace ONE Access, or they can be sent to Workspace ONE Intelligence for analytical purposes. For example, User login activity data can be used in Intelligence to identify user behavior anomalies and notify the Customer IT administrator. Sending logs to Intelligence is configurable and optional functionality.
This section covers Workspace ONE Hub Services (“Hub Services”), which provide Users with a single destination to access, discover, and connect with corporate resources, applications, teams, and workflows via the Workspace ONE Intelligent Hub application.
a. Overview of Workspace ONE Hub Services
Hub Services provide a collection of services that are co-located with Workspace ONE Access and can be deployed On-Prem or as a Hosted Service. Customers can choose to enable one or more Hub Services capabilities:
b. Collection of User and Device Data Through Hub Services
i. Authentication. Hub Services relies on UEM or Access for user authentication as defined by Customer’s IT administrator in the UEM Console as part of source of authentication configuration.
ii. User Data. Customers can use Hub Service admin console to create and send push notifications to Users. In addition, notifications can be generated based on changes in third party business systems when integrated via Workspace ONE Mobile Flows. Notification related data generated through Hub Services admin console or Mobile Flows is stored in Hub Services data store. In addition to the notification content, Hub Service collects individual notification acted on state, and target User device identifiers including UUID.
Customers can turn on the app rating feature to collect User feedback. When enabled, Hub Services collects User’s external Id and app Id. Customer IT administrators can download a report of aggregated app ratings with following data points: App Name, App ID, Platform, App Version, App Type, Catalog Provider, Likes and Dislikes. Hub Services does not disclose individual User ratings for different apps to Customer’s IT administrator.
When User favorites/unfavorites an app, Hub Services stores app Id favorited/unfavorited by User along with the device type to indicate the platform from which User has favorited/unfavorited the app from.
When User searches for a colleague using People tab, Hub Services stores the most recent search result for that User.
iii. Logging Data. Workspace ONE Hub Services generates audit logs for User activity. Hub Services logs the source of authentication (UEM or Access), username, external Id and app Id. For instance, app Id is logged: 1) when Users favorites or unfavorites an app; 2) when Users change the order of apps in favorites tab; 3) when install action is invoked on an app; or 4) when apps are launched from Hub Services app.
This section covers Workspace ONE Mobile Flows, ("Mobile Flows"), which is a Hosted Service built for the VMware Workspace ONE platform that provides contextual workflows and integrations to third-party systems or applications all within the digital workspace.
a. Overview of the Workspace ONE mobile flows
Mobile Flows integrates with third-party systems or applications (e.g. Salesforce, Concur, Coupa, etc .) and presents standardized notifications within Workspace ONE applications (e.g. Workspace ONE Intelligent Hub or Workspace ONE Boxer). Mobile Flows allows Customers to leverage VMware out-of-the-box (“OOTB”) connectors or build their own custom connectors and configure them in the Workspace ONE UEM Console so their Users can complete tasks and/or take actions across third party systems or applications without leaving Workspace ONE applications.
b. Collection of User and Device Data Through the Workspace ONE Mobile Flows Software
i. Authentication Data. Users are authenticated to the third-party systems or applications to see contextual information and take actions in those systems via VMware Workspace ONE Access by providing a signed token to identify the User, which is used to exchange User access tokens with federated third-party systems. These access tokens are encrypted and cached for rapid retrieval, and are deleted on expiration within the Mobile Flows service. Mobile Flows supports multiple authentication types for third-party systems so the exact token exchange flow may vary depending on the system.
ii. Stateless Connectors to Backend Systems. If Customers choose to use the OOTB connectors, Mobile Flows will process information from third-party systems and send it in a structure format to the Workspace ONE applications. All connectors deployed as out-of-the-box are stateless, holding no data about the request and response, completing all work in a single call, and logging no personally identifiable information to logs.
This section covers Experience Workflows powered by Boomi, which is an optional feature add-on available for Hub Services.
a. Overview of the Workspace ONE Experience Workflows
Experience Workflows is powered by Boomi and enables integration with third-party systems or applications (e.g., Salesforce, Concur, Coupa, etc.) to present standardized notifications within Workspace ONE Intelligent Hub. Experience Workflows allows Customers to leverage VMware out-of-the-box (“OOTB”) integration packs or build their own custom integrations and configure them in Workspace ONE Hub Services and Boomi Atomsphere so their Users can complete tasks and/or take actions across third party systems or applications without leaving Workspace ONE Intelligent Hub.
b. Collection of User and Device Data Through the Workspace ONE Experience Workflows Software
i. Stateless Integrations to Backend Systems. If Customers choose to use the OOTB integration packs, Experience Workflows will process information from third-party systems and send it in a structure format to the Workspace ONE Intelligent Hub. All integration packs deployed as out-of-the-box are stateless, holding no data about the request and response, completing all work in a single call, and logging no personally identifiable information to logs. The information sent by Workspace ONE through Experience Workflows will depend on the use case and nature of the third party system being integrated. Please check with your third party vendor(s) for information about their applicable privacy policies and disclosures.
This section covers Workspace ONE Mobile Threat Defense service (“MTD”), which is an optional feature add-on available for Hub Services and is a Hosted Service powered by Lookout, Inc., including the related mobile applications.
a. Overview of the Workspace ONE Mobile Threat Defense Service
The Workspace ONE Mobile Threat Defense service helps Customers to protect the confidentiality, security and integrity of Customer systems and information that are accessed by Users from corporate-owned and User-owned devices by helping to detect and protect against threats to the security of those devices. MTD provides the Customer with controls which enable them to respond to threats to enrolled mobile devices. MTD consists of a Customer-specific console, which enables the Customer to monitor threats to its Users’ devices (“Console”), and software that is installed on a User’s device. The specific features available, and the applicable on-device software application, will depend on the specific version/bundle purchased, how the Customer configures MTD, and which devices/platforms (i.e., iOS, Android, Windows, etc.) are used by the Users. The Console is hosted by VMware’s service provider, Lookout, Inc.
b. Console Controls
The specific features and settings available through the Console will depend on the specific version/bundle purchased and which devices/platforms (i.e., iOS, Android, Windows, etc.) are used by the Users. Customer can also choose to enable different settings for corporate-owned devices and User-owned devices. In the Console, Customers can customize threat classifications and set their own threat response policies accordingly (e.g., Alert, Warn, Block, etc.). Some of the other options available to Customers are outlined below:
i. Data Collection
Customer may elect for the Console to maintain a username and email address for each enrolled device, or may elect for the Console to rely solely on a pseudonymized Device ID provided by the UEM platform. With the latter option, Customers’ administrators would need access to the UEM platform to make the association between the device threat data within the Console and the individual User.
ii. Display of User Data
Customers may elect to redact certain fields within threat data from administrators’ view within the Console. Fields that may be redacted include IP address and resultant geolocation, SSID of suspect networks, name of suspect apps, and suspect or blocked URLs and domains.
c. Collection of User and Device Data for MTD
User data that may be collected by MTD varies depending on the specific version/bundle purchased by the Customer, how the Customer configures MTD, and which devices/platforms (i.e., iOS, Android, Windows, etc.) and mobile applications are used by the Users. Examples of data collected by MTD are provided below.
Device and User Identifiers
Firmware / OS / Configuration Data
Phishing and Content Protection (PCP) Data
This section covers Workspace ONE Intelligence (“Intelligence”), which is a Hosted Service built for the VMware Workspace ONE platform that provides insights, analytics and automation for the entire digital workspace.
a. Overview of the Workspace ONE Intelligence
Workspace ONE Intelligence Software provides insights into a Customer’s digital workspace by aggregating and correlating device, application and User data together from multiple data sources in one place to give Customer’s IT administrators a complete view of their entire digital workspace environment. Customers can use reports and dashboards to monitor trends and take actions using the automation feature to mitigate issues. Customers opt-in for Workspace ONE Intelligence using the UEM console to access the Intelligence console and configure the data sources that Customer wishes to use. Workspace ONE Intelligence is able to ingest data from the following sources:
b. Collection of User and Device Data Through the Workspace ONE Intelligence Software
i. Data Collection from UEM. UEM data flows to Intelligence only after Customer has opted in. The type of data collected from UEM depend on the privacy controls that the Customer has configured. Refer to the UEM section for details on privacy controls.
The Workspace ONE Intelligent Hub app also sends app health, and device health data from corporate-dedicated and corporate-shared Windows devices directly to Intelligence once Customer opts in to this feature in the UEM console. This data may include app crashes, app hang, OS crashes, boot time, logon/shutdown time, windows service start/stop events, sleep and wake events, and device performance monitoring data. This feature is not available for User-owned devices (BYOD).
Customers can use this data set to create dashboards and reports to monitor different key performance indices (KPIs) for maintenance and visibility. Customers can also use the automation feature to take actions on devices, and issue notifications.
ii. Data Collection from Access. Customers configure Access integration in Intelligence to allow data from Access to flow into Intelligence platform. The type of data may include app logon and logout events. Please refer to Access section for details.
For example, Customers can use this data set to check User login trend, unique User logins, login failure by authentication method and top 5 apps launched in last week.
iii. Data Collection from CVE. Intelligence retrieves list of common vulnerabilities and exposure entries from the CVE database. This list includes publicly known cybersecurity vulnerabilities. Customers can use this data to measure security threats to their digital workspace and take actions to mitigate issues. Details of these integration and data collection are also provided in Workspace ONE Intelligence documentation which can be reviewed here.
iv. Data Collection from Trust Network Technology Partners. The type of data collected by Intelligence depends upon the privacy settings and terms of agreement between Customer and Trust Network technology partnerspartners. Workspace ONE Intelligence can integrate with Trust Network technology partners by configuring technology partner’s APIs in Intelligence to ingest data or allowing Customer to create credentials for technology partner to use Intelligence APIs to send data to Intelligence. The type of integration is determined by the Customer.
Sample data available in Intelligence from Trust Network technology partners may include but is not limited to:
Customers can use this data set to improve visibility across their organization for security threats and take actions using the automation feature to take actions to mitigate the risks.
v. Data collection from Intelligence SDK. By integrating the Workspace ONE Intelligence Software Development Kit (the “Intelligence SDK”), Customers can analyze and interact with data about app engagement, app failures, network insights, and user flows. Sample of data may include:
VMware mobile applications also use Intelligence SDK. Please visit UEM section for details.
Customers use this data set to find the root cause of crashes and other application errors quickly, and to prioritize which crashes need to be fixed in order to improve application engagement and usage.
Details of this integration and data collection are also provided in Workspace ONE Intelligence documentation here.
The Software can collect crash reports, including those from the VMware Mobile Apps (“Crash Reports”). A Customer IT administrator can disable the collection of Crash Reports via the Console settings. Crash Reports may contain User data, such as IP/MAC address, device Information (including unique identifiers, device type, carrier, operating system, model, system, etc.), and geo-location information. Crash Reports are provided to the Customer via the Software to enable the Customer to troubleshoot User issues. VMware may also use Crash Reports to improve our products and services and troubleshoot and provide support to our Customers.
VMware collects certain configuration, performance, usage and other analytics data from our Customers and our Customer’s Users for a variety of purposes including to improve our products and services, fix problems, help us understand better how our Customers use our products and services, and advise our Customers on how best to deploy and use our products and services. There are several different data collection programs that a Customer/User may participate in when using the Workspace ONE branded products and services. Please see the VMware Trust & Assurance page for more information.
VMware may monitor and collect configuration, performance, usage, and consumption data relating to Customer’s and its Users’ use of the Software to facilitate the delivery and operation of the products and services (collectively, “Operational Data”) as described in the VMware Privacy Notice.
As part of the device enrollment process, the Software pushes a privacy dialog to the User’s mobile device, which enables the User to review a summary of the settings enabled for the Software on their device. In some cases, the User may also have the ability to control the enablement of certain features of the Software, via the self-service portal and/or their device settings. Most VMware Mobile Apps made available by VMware have a privacy dialog that includes (i) an overview of the data collected by the mobile application, (ii) the permissions that the mobile application will request, and (iii) an option to send analytics data to VMware (unless the Customer has disabled the sending of analytics data for all Users). The Software also provides functionality that Customers can use through the Console to provide Users with a link to their privacy notice via the privacy dialog.
The portions of the Software that allow devices to be monitored by the Console run in the background of the devices, and may not provide additional notice when these functions are occurring in real time.
VMware has no direct relationship with the Users whose data it processes in connection with providing the Software and any related services. A User who seeks access, or who seeks to correct, amend, or delete inaccurate data should direct their query to the Customer. If the Customer requests VMware to modify or remove the data, we will respond to the Customer’s request in accordance with our agreement with the applicable Customer or as may otherwise be required by applicable law.