---
title: "Acquia Support Privacy Notice"
date: "2026-05-27T19:15:48+00:00"
summary: "Understand how Acquia Support handles your personal data—privacy practices, security measures, and compliance details explained clearly."
image:
type: "page"
url: "/service-offerings/acquia-support-privacy-notice"
id: "86af3ea4-8359-47f1-b225-eee21d1d8305"
---

Acquia Support
--------------

  
Last revision of this Product Notice: \[v1.2  – 28 May 2026  – Ai-related Processing Operations details added\]  
Prior version(s) of this Product Notice: \[v1.1 – 17 May 2021 – hyperlinks updated\]  
This Product Notices describes the privacy relevant aspects of the above-mentioned Acquia product/services.  
 

### About the Product

  
Acquia and its Acquia Affiliates support the Services remotely from various facilities around the globe where Acquia or its Acquia  
Affiliates employ personnel to deliver and support the Services. Such Services include:

*   Service monitoring, including the underlying infrastructure and security
*   Support and troubleshooting when Customers submit support tickets via online ticket systems, phone, or similar communication channels
*   Backup and restoration of Customer Data stored in the Services
*   Release and development of additional features, updates, fixes to the Services  
     

For details about this Service, please refer to the Product Description available online at [https://docs.acquia.com/guide](https://docs.acquia.com/guide).  
 

### 1\. Processing Operation(s)

  
Processing of Personal Data to deliver its core functionalities required: ☐ yes ☒ no

*   Optional features processing Personal Data: ☒ yes ☐ no
    *   The optional features are deactivated by default: ☐ yes ☒ no ☒ n/a\*
*   Processing of sensitive Personal Data: ☐ yes\*\* ☒ no ☐ n/a\*
*   Profiling of individuals based on personal characteristics: ☐ yes ☒ no ☐ n/a\*
*   Automated decision making that produces legal or other significant impacts on individuals: ☐ yes ☒ no ☐ n/a\*\*
*   Processing via an AI tool available with the Product ☒ yes ☐ no
    *   The AI feature is deactivated by default: ☐ yes ☒ no ☐ n/a\*
    *   The AI feature processes Personal Data: ☐ yes ☒ no ☐ n/a\* (PII is redacted when questions are processed)
    *   The AI feature processes sensitive Personal Data ☐ yes ☒ no ☐ n/a\* (PII is redacted when questions are processed)
    *   The Customer can control what data the AI tool processes: ☐ yes ☒ no ☐ n/a\*

\* (n/a = not applicable)  
\*\* (optional; depends on the Customer’s Drupal application)

###   
2\. Details of Personal Data being processed

Categories of Personal Data

Categories of Data Subjects

Purpose of Processing

Categories of Data Recipients

Needed for Core Features

Processing Location

Acquia Inc. acts as Processor

Customer determines the categories of data provided to Acquia when requesting support services. It is in Customer’s sole discretion to provide no or very limited personal data, e.g. through the use of generic email addresses, masking of personal data, etc. 

Typically, the following categories of personal data are provided to Acquia: name, phone numbers, email addresses, time zones, addresses, company names, contract data, invoice data, and background information regarding the support case, e.g. data specific to the affected Service or Drupal installation. 

Customer determines the categories of data subjects provided to Acquia when requesting support services. It is in Customer’s sole discretion to provide no or very limited personal data, e.g. through the use of generic email  
addresses, masking of personal data, etc.  
Typically, personal data related to following data subjects is provided: employees, contractors, business partners or other individuals acting on behalf of the Customer.  
 

Providing advice, support, and troubleshooting in accordance with the relevant support agreement.

Support technicians of Acquia

N/A 

Globally (see Acquia Affiliates)

Yes

###   
3\. Privacy Enhancements

Objective

Technology / Measure

Data at Rest 

Data in Transit

Anonymization and Pseudonymization

Data anonymization at Customer level optional for Customer

N/A

N/A

Data confidentiality

Access control measures  
Encryption at customer level  
Encryption at Acquia level  
(see [Security Annex](https://security.acquia.com/) and [Product Description](https://docs.acquia.com/service-offerings/support-users-guide))

Yes

N/A

Yes

Yes

N/A

Yes

Data integrity

Anti-tampering technology (see [Security Annex](https://security.acquia.com/))

Yes

Yes

Data availability including restoring availability, restoring access to personal data, and data resilience

Business continuity and disaster recovery measures (see [Security Annex](https://security.acquia.com/))

Yes

Yes

Regular testing, assessing and evaluating of TOMs

Regular security and process reviews (see also [Security Annex](https://security.acquia.com/))

Yes

Yes

###   
4\. Certifications

The relevant certifications can be found here: [https://docs.acquia.com/cloud-platform/arch/security/compliance-standards-and-regulations/](https://docs.acquia.com/cloud-platform/arch/security/compliance-standards-and-regulations/).  
 

### 5\. Data Subject Rights

Not applicable.  
 

### 6\. Sub-Processing

  
The specific list of Acquia Affiliats (sub-processors) is available from: [https://www.acquia.com/about-us/legal/subprocessors](https://www.acquia.com/about-us/legal/subprocessors). Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through above website.  
 

### 7\. Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached)  
 

Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex (available from https://www.acquia.com/about-us/legal/gdpr) applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by data exporter in conjunction with the Services.