- “Personal Information” is any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- “Process” or “Processing” means any operation which is performed upon Personal Information, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Information We Collect
We collect your Personal Information in the following ways:
- Information from your use of the Services: We may receive information about how and when you use the Services, store it in log files or other types of files associated with your account, and link it to other information we collect about you. This information may include, for example, your IP address, time, date, browser used, and actions you have taken within the application. This type of information helps us to improve our Services for both you and for all of our Customers.
- Web beacons: We use web beacons, also called pixel tags, on our Websites and in our emails. When we send emails to Customers, we may track behavior such as who opened the emails and who clicked the links. This allows us to measure the performance of our email campaigns and to improve our features for specific segments of Customers. To do this, we include a single pixel tag in emails we send. These tags allow us to collect information about when you open the email, your IP address, your browser or email client type, and other similar details. We also include single pixel tags in the emails we deliver, through the Platform, on our Customer’s behalf. We use the data from those web beacons to create reports about how our Customer’s email campaign performed and what actions their Recipients took with respect to that email. Similarly, reports are also available to us when we send email to you, so we may collect and review that information to analyze how our email campaigns to Customers performed and what actions our Customers took with respect to that email.
- Contest and Sweepstakes: We may, from time to time, offer surveys, contests, sweepstakes, or other promotions on our Websites or through social media (collectively, “Promotions”). Your participation in our Promotions is completely voluntary. Information requested for entry may include personal contact information such as your name, address, date of birth, phone number, email address, username, and similar details. We use the information you provide to administer our Promotions. We may also, unless prohibited by the Promotion’s rules or law, use the information provided to communicate with you, or other people you select, about our Services. We may share this information with our Affiliates and other organizations or Service Providers in line with this policy and the rules posted for the Promotion.
- Blog: We have public blogs on our Websites. Any information you include in a comment on our blog may be read, collected, and used by anyone. If your Personal Information appears on our blogs and you want it removed, please contact us at firstname.lastname@example.org. If we are unable to remove your information, we will tell you why.
- Social media platforms and widgets: Our Websites may include social media features, such as the Facebook Like button. These features may collect information about your IP address and which page you are visiting on our Website, and they may set a cookie to make sure the feature functions properly. Social media features and widgets are either hosted by a third party or hosted directly on our Website. We also maintain presences on social media platforms including Facebook, Twitter, and LinkedIn. Any information, communications, or materials you submit to us via a social media platform is done at your own risk without any expectation of privacy. We cannot control the actions of other users of these platforms or the actions of the platforms themselves. Your interactions with those features and platforms are governed by the privacy policies of the companies that provide them.
- Information from other sources: We may, from time to time, obtain information about you from third party sources, such as public databases, third party data providers, and our joint marketing partners. We take steps to ensure that such third parties are legally permitted or required to disclose such information to us. Examples of the information we may receive from other sources include: demographic information, company information, device information (such as IP addresses), location, and online behavioral data (such as information about your use of social media websites, page view information, and search results and links). We use this information, alone or in combination with other information (including Personal Information) we collect, to enhance our ability to provide relevant marketing and content to you and to develop and provide you with more relevant products features, and services.
Use and Disclosure of Your Personal Information
We may use and disclose your Personal Information only for the following purposes:
- To send you informational and promotional content in accordance with your marketing preferences. You can manage your preferences to receive specific content in our subscription center (which is available by clicking the “Email Subscription Center” link found in the footer of our marketing emails) or choose to stop receiving these emails altogether by following the unsubscribe instructions included in every marketing email.
- To bill and collect money owed to us by our Customers. This includes sending you emails, invoices, receipts, notices of delinquency, and alerting you if we need a different credit card number. We use third parties for secure credit card transaction processing, and we send billing information to those third parties to process your orders and credit card payments.
- To communicate with our Customers about their account and provide customer support.
- To protect the rights and safety of our Customers and third parties, as well as our own.
- To meet legal requirements, including complying with court orders, valid discovery requests, valid subpoenas, and other appropriate legal mechanisms.
- To provide information to representatives and advisors, including attorneys and accountants, to help us comply with legal, accounting, or security requirements.
- To prosecute or defend a court, arbitration, or any other legal proceeding.
- To respond to lawful requests by public authorities, including to meet national security or law enforcement requirements.
- To provide, support, and improve the Services we offer. This includes our use of the data that our Customers provide us in order to enable our Customers to use the Services to communicate with their Recipients. This also includes, for example, aggregating information from your use of the Services and sharing this information with third parties to improve our Services. This might also include sharing your information or the information you provide us about your Recipients with third parties in order to provide and support our Services or to make certain features of the Services available to you. When we do have to share Personal Information with third parties, we take steps to protect your information by requiring these third parties to enter into a contract with us that require them to use the Personal Information we transfer to them in a manner that is consistent with this policy.
Disclosure of Personal Information to Third Parties
- Business Partners. From time to time, SparkPost may partner with other companies to jointly offer products, services or programs including, for example, webinars, events, downloadable content, or integrated features. If you purchase, specifically express interest in, or register for a jointly offered product, service, or program from or through SparkPost, we may share your Personal Information collected in connection with your purchase or expression of interest with our business partners. SparkPost does not control our business partners’ use of shared Personal Information and their use of such information will be in accordance with their own privacy policies. If you do not wish for your information to be shared in this manner, you may opt to not purchase or specifically express interest in a jointly offered product or service.
- Information Disclosed for our Protection and the Protection of Others. We may disclose information about you to third parties: (a) if we are required to do so by law, court order or legal process; (b) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (c) under the discovery process in litigation; (d) to enforce SparkPost policies or contracts; (e) to collect amounts owed to SparkPost; (f) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (g) if we, in good faith, believe that disclosure is otherwise necessary or advisable. In addition, from time to time, server logs may be reviewed for security purposes including, for example, to detect unauthorized activity on the Services. In such cases, server log data containing Personal Information may be shared with law enforcement bodies so that they may identify users in connection with their investigation of the unauthorized activities.
Data Collected for and by our Customer
If you are a Recipient and no longer want to be contacted by one of our Customers, please unsubscribe directly from that Customer’s emails or contact the Customer directly to update or delete your data. If you contact us, we may remove or update your information within a reasonable time and after providing notice to the Customer of your request.
Content of Emails Sent
When a Customer sends an email to a Recipient, it bounces from server to server as it crosses the Internet. Along the way, server administrators can read what you send. Email was not built for sending confidential information and most emails end up in an unencrypted inbox. Please do not use the Services to send confidential information.
Usage Data and Aggregate Data
Where you have consented to SparkPost’s Processing of your Personal Information, you may withdraw that consent at any time and opt out by following the instructions below. Additionally, before we use Personal Information for any new purpose not originally authorized by you, we will provide information regarding the new purpose and give you the opportunity to opt out. Note that, due to the nature of the Services, you may have to provide the email address or other identifying value that is associated with your Personal Information in order for SparkPost to segregate out the use and retention of such Personal Information. Where consent of the individual for the Processing of Personal Information is otherwise required by law or contract, SparkPost will comply with the law or contract.
Sensitive Personal Data
“Sensitive Personal Data” is a subset of Personal Information, which due to its nature, has been classified by law or by policy as deserving additional privacy and security protections. Sensitive Personal Data includes Personal Information regarding EU-residents that is classified as a “Special Category of Personal Data” under EU law, which consists of the following data elements: (a) race or ethnic origin; (b) political opinions; (c) religious or philosophical beliefs; (d) trade union membership; (e) genetic data; (f) biometric data where Processed to uniquely identify a person; (g) health information; (h) sexual orientation or information about the individual’s sex life; or (i) information relating to the commission of a criminal offense.
SparkPost does not collect Sensitive Personal Data from you. However, if we do ever collect it, we will, prior to disclosing it to a third party or Processing it for a purpose other than its original purpose or the purpose authorized subsequently by the individual, obtain your consent. Where consent of the individual for the Processing of Personal Information is otherwise required by law or contract, SparkPost will comply with the law or contract.
“Do Not Track”
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. At this time, there is no general agreement on how companies like SparkPost should interpret DNT signals. Therefore, SparkPost does not recognize or respond to browser-initiated DNT signals, whether that signal is received on a computer or a mobile device.
THE EUROPEAN ECONOMIC AREA AND GDPR.
Legal Basis for Processing EU Personal Information
Where SparkPost is a controller of data (e.g., when collected via the Websites or for billing purposes for Customers), the legal basis is either legitimate interest or consent depending on the type of information subject to processing and the information we receive from upstream partners. We may also process data for the performance of a contract with you. Where we rely upon legitimate interest, we have assessed the processing is not high risk, does not involve the processing of sensitive data and will not violate fundamental human rights. With respect to providing the Platform to Customers, SparkPost is a processor of data and the legal basis for processing such data is determined by each Customer.
Data Protection Addendum
While the data protection, privacy, and other laws of the United States might not be as comprehensive as those in your country, if you or your Recipients reside in the European Economic Area, we take many steps to protect your and your Recipients’ privacy, including offering a Data Protection Addendum (DPA), which is available at: https://www.sparkpost.com/policies/DPA.
Cross-Border Data Transfers
SparkPost primarily stores Personal Information in the United States and the European Union (as applicable), in the cloud, our servers, the servers of our Affiliates, or the servers of our Service Providers. To facilitate our global operations, we may transfer and access such information from around the world.
Privacy Shield Framework
SparkPost participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. We are committed to subjecting all Personal Information received from European Union (EU) member countries and Switzerland, respectively, in reliance on each Privacy Shield Framework, to the Framework’s applicable Principles. To learn more about the Privacy Shield Frameworks, and to view our certification, please visit the U.S. Department of Commerce’s Privacy Shield website: https://www.privacyshield.gov/welcome. A list of Privacy Shield participants is maintained by the Department of Commerce and is available at: https://www.privacyshield.gov/list.
With respect to Personal Information received or transferred pursuant to the Privacy Shield Frameworks, we are subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
If your Personal Information was received in reliance on either Privacy Shield Framework and you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider JAMS, at no cost to you, at https://www.jamsadr.com/eu-us-privacy-shield. Under certain conditions, more fully described on the Privacy Shield website, https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, you may be entitled to invoke binding arbitration after other dispute resolution procedures have been exhausted.
EU Data Subject Rights
The General Data Privacy Regulation (“GDPR”) affords additional rights to EU data subjects. Those rights include the right to complain to EU Supervisory Authorities and the right to access, receive a copy of, correct, delete, block, and limit or object to the processing of your Personal Information processed by SparkPost. Where otherwise permitted by applicable law, you may contact us at email@example.com to request access to, receive, port, restrict Processing, seek rectification or request erasure of Personal Information held about you by SparkPost. Such requests will be carried out in accordance with applicable laws. Although SparkPost makes good faith efforts to provide you with access to your Personal Information, there may be circumstances in which SparkPost is unable to provide access, including for example, where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where it is commercially proprietary. If SparkPost determines that access should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, SparkPost will take reasonable steps to verify your identity before granting access to or making any changes to your Personal Information.
Access Rights for Recipient Personal Information
As a data processor for our Customers, SparkPost Processes data in connection with the Platform, which may include Recipient Personal Information on behalf of our Customers. We will not use, share, distribute, or reference any such Recipient Personal Information except as provided in the applicable agreement between us and our Customer, or as may be required by law. If Personal Information pertaining to you as an individual has been submitted to us by a Customer as Recipient Personal Information and you wish to exercise any rights you may have to access, receive, port, restrict Processing, seek rectification, or request erasure, please inquire with the applicable Customer directly. Because SparkPost personnel have a limited ability to access Recipient Personal Information, if you wish to make your request directly to SparkPost, please provide the name of the applicable SparkPost customer as part of that request. We will refer your request to that Customer and will support them as needed in responding to your request within the timeframe required by applicable law.
We take reasonable and appropriate measures to protect Personal Information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in the Processing and the nature of the Personal Information.
Our credit card processing vendor uses security measures to protect your information both during the transaction and after it is complete. Our vendor is certified as compliant with card association security initiatives, including the Visa Cardholder Information Security and Compliance (CISP), MasterCard® (SDP), and Discovery Information Security and Compliance (DISC). We also perform annual SOC II audits. If you have any questions about the security of your Personal Information, you may contact us at firstname.lastname@example.org.
SparkPost accounts require a username and password to log in. You must keep your username, password, and API key(s) secure, and never disclose them to a third party. If you have reason to believe that your passwords or Personal Information is no longer secure, please promptly notify us at email@example.com.
OTHER RIGHTS AND IMPORTANT INFORMATION.
Due to the nature of SparkPost’s business, our Services are not marketed to minors. SparkPost does not knowingly solicit or collect Personal Information from children under the age of 13 (and in certain jurisdictions under the age of 16). This applies to any Personal Information directly collected by us but does not apply to the Personal Information provided to us by third party services and organizations or from our Customers regarding their Recipients (please refer to the terms of their respective privacy policies). If we learn that we have collected Personal Information from a child under the age of 13 (and in certain jurisdictions under the age of 16) in relation to the Services, we will promptly delete that information.
California Privacy Rights
California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of Personal Information disclosed to those parties. If you are a California resident and would like to make such a request, please submit your request to firstname.lastname@example.org.
Links to Third Party Websites
v3.1 May 14, 2019