ServiceNow

What ServiceNow does and how it appears on a website

ServiceNow Inc. is a publicly traded US software company that operates the Now Platform, a low code workflow engine that powers IT Service Management, Employee Experience, Customer Service Management, Field Service, GRC, HR and many vertical solutions. European enterprises use ServiceNow portals as public service catalogues (customer.service-now.com), employee self-service hubs and incident reporting interfaces. The portals are built on top of UI Builder, ServiceNow Service Portal or the newer Workspace experience.

Cookies and data collected by ServiceNow

ServiceNow sets first party cookies on the instance domain such as JSESSIONID, glide_user, glide_session_store and BIGipServer for session management and load balancing. Optional integrations add analytics cookies (Adobe Analytics, Mixpanel, Pendo, Glassbox). For embedded chat widgets and Virtual Agent, ServiceNow may set glide_va_session and other interaction cookies. Personal data collected through the portal flows into the underlying ServiceNow tables.

GDPR and ePrivacy implications

ServiceNow Inc. is processor for the data the customer puts into the platform and controller for its own customer support, sales and product telemetry. The ServiceNow DPA (Customer Data Processing Addendum) incorporates the European Commission Standard Contractual Clauses, lists sub-processors and binds ServiceNow to ISO 27001, ISO 27018, SOC 2, EU Cloud Code of Conduct and FedRAMP for US government workloads. Strictly necessary cookies for session and security are exempt from ePrivacy consent; optional analytics or marketing cookies require opt-in.

International data transfers and ServiceNow EU Cloud

ServiceNow Inc. is certified under the EU-US Data Privacy Framework. EU customers can choose to host their instance in Ireland, the Netherlands, Germany, the United Kingdom or Switzerland. The ServiceNow EU Cloud, generally available since 2024, contractually keeps customer data and most operational processing inside the EU, with EU based support engineers and EU only sub-processors. Personal data continues to be subject to US extraterritorial laws because the parent company is American.

Consent and legal basis

Contractual necessity (Article 6(1)(b) GDPR) covers most customer and employee portal scenarios where the user has signed up for a service or is acting in an employment relationship. Legitimate interest (Article 6(1)(f)) covers security telemetry and ITSM operations. Consent (Article 6(1)(a)) is required for optional analytics, marketing and Pendo session replay style cookies.

Practical compliance steps

Sign the ServiceNow DPA, opt into ServiceNow EU Cloud if the workload contains EU personal data, restrict instance access through role based controls, configure data retention plug-ins, encrypt sensitive fields with the Edge Encryption add on, list ServiceNow as a processor in the privacy notice, document the transfer impact assessment, and integrate every non strictly necessary cookie of the customer portal into the Consent Management Platform.