Contentsquare Solution’s User Privacy Policy

The other processing activities performed by Contentsquare in relation to our website visitors, visitors of our customers’ websites/apps in connection with our services, and job applicants are governed by separate Privacy Policies available at  this link.

Controller’s representative

Content Square SAS has been designated as Contentsquare’s representative in the European Union for data protection matters pursuant to Article 27 of the General Data Protection Regulation.

Data Protection Officer and contact details

Contentsquare has appointed DPOs to oversee the protection of your Personal Data. If you have any questions about this privacy policy or about our data protection practices, you can contact our DPOs at:

• Global DPO: Content Square SAS, Attn: Global DPO, 7 rue de Madrid 75008 Paris, France;

• APAC DPO: Contentsquare Japan G.K., Attn: APAC DPO, Marunouchi Kitaguchi Building 9F Wework 1-6-5 Marunouchi Chiyoda-ku Tokyo 100-0005, Japan.

or via email using this link.

Below you will find a summary of the purposes for which we process your Personal Data with the corresponding legal basis and retention period:

“Marketing” means when we contact you about our Services or send you communications about Contentsquare’s services, business, contests and events (including communications based on your interests, personal and business characteristics, and location) and ensure current contact information is accurate. We may provide such notices through any of the contact means available to us (e.g. phone or email), through the Services, or through our marketing campaigns on any other means.

We use Personal Data that is collected during the Customer relationship, such as from surveys and online behavioral data for marketing optimization. Based on this Personal Data, we are able to make marketing more relevant and effective, and send you more personalized communications such as newsletters, special offers and sales, new product announcements, etc. or any other information we think you will find valuable. 

“Internal Development” means when Contentsquare improves and better develops the Services for our Customers including testing, research, reporting, benchmarking, machine learning, analysis about our Services performance, predictions, and trends in order to support our business decision-making, to analyze our Customers’ experiences, satisfaction, and engagement with our Services, to assess the quality of our Services, and to consider our Customers’ feedback and needs.

In connection with one or more of the purposes outlined in the Section 4 above, we may disclose your Personal Data to: 

Contentsquare subsidiaries and affiliated companies

We may share, disclose, and transfer your Personal Data with our current (please see the list here) and future subsidiaries and affiliated companies for all purposes mentioned in Section 4 above.

Service providers

We use third parties service providers to perform services complementary to our own and support our business. These services include data hosting, data analytics, IT services and cybersecurity, customer services, payment services, consulting, development, support, marketing and advertising, events, promotions and contests. Some of our service providers may perform the Services on our behalf, under our instructions, in accordance with our agreement and in compliance with appropriate technical and organizational security measures to protect your Personal Data. We may also use data broking service providers for Marketing Communications purposes, including data enrichment, data matching, data cleansing and tracing. While some of these service providers may act as a Data Controller, we undertake appropriate and careful due diligence before using their services and they perform their services in accordance with our agreement.

Please see here for the current list of service providers used by Contentsquare as processors.

Integrations and enrichment providers

Our tool allows customers to integrate third-party tools to send or receive Personal Data to and from the Contentsquare solution in connection within the Contentsquare Services. Our customers remain responsible for any Users Personal Data transmissions between these integration tools and Contentsquare.

Our Contentsquare Digital Experience Alerts is enabled by Microsoft Bot Framework. The Microsoft Bot Framework is a set of web-services that enable intelligent services and connections using conversation channels you authorize. As a service provider, Microsoft will transmit content you provide to our bot/service in order to enable the service. For more information about Microsoft privacy policies please see their privacy statement here: http://go.microsoft.com/fwlink/?LinkId=521839. In addition, your interactions with this bot/service are also subject to the conversational channel’s applicable terms of use, privacy and data collection policies. To report abuse when using a bot that uses the Microsoft Bot Framework to Microsoft, please visit the Microsoft Bot Framework website at https://www.botframework.com and use the “Report Abuse” link in the menu to contact Microsoft.

Other third parties

We may disclose your Personal Data to third parties, including:

• Partners for marketing, advertising, promotions, contests, events or other similar purposes;

• A buyer, investor or other third party in the event that Contentsquare, or any portion, group thereof, undergoes a business transition, such as a merger or acquisition, or during steps in contemplation of such activities (e.g., negotiations and due diligence).

• Government authorities or public authorities, courts, intergovernmental or supranational bodies for legal processes or protection of life and safety where we believe in good faith that access, use, preservation, or disclosure of the information is legally or reasonably necessary.

Contentsquare has implemented safeguards to ensure an adequate level of data protection where your Personal Data is transferred to countries outside the EEA, such as:

• the recipient country has an adequacy decision from the European Commission;

• the European Commission’s Standard Contractual Clauses for the transfer of Personal Data;

• Self certification to the Trans-Atlantic Data Privacy Framework.

To see in detail the countries where your Personal Data may be transferred, please click here.

Trans-Atlantic Data Privacy Framework Notice

Contentsquare’s entities which are based in the United States of America (Content Square, Inc. and Clicktale Inc.) (together “the US CS entities”) have self-certified with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (together, the “Data Privacy Framework”), where such participation is listed at this link, with respect to the Personal Data of individuals residing in the EU, United Kingdom, and Switzerland that the US CS entities process for the purposes identified above in this policy, including any such data processed on behalf of any of their affiliated companies of the Contentsquare group of companies. 

The US CS entities commit to process Personal Data received from the EU, United Kingdom, and Switzerland in accordance with the Data Privacy Framework Principles, including the Supplemental Principles (collectively, the “Principles”) as set forth by the US Department of Commerce concerning the processing of Personal Data.

If there is any conflict between this User Privacy Policy and the Principles, the Principles shall govern. To learn more about the Data Privacy Framework, please visit this webpage.

Independent Dispute Resolution

To address inquiries or resolve complaints about our processing of personal data, residents of the EU, United Kingdom, or Switzerland should first contact Contentsquare via e-mail to privacy[at]contentsquare.com. 

The US CS entities have further committed to refer unresolved privacy complaints under the Data Privacy Framework to the American Arbitration Association’s International Centre for Dispute Resolution (“ICDR-AAA”), a non-profit alternative dispute resolution provider located in the United States to assist with the complaint resolution process. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://go.adr.org/dpf_irm.html for more information and to file a complaint. The services of ICDR-AAA are provided at no cost to you.

Enforcement

The US CS entities are subject to the investigatory and enforcement powers of the Federal Trade Commission (the “FTC”) to ensure our compliance with the Data Privacy Framework as outlined in this User Privacy Policy.

Arbitration

You may be entitled, under certain conditions as described in the Principles, to invoke binding arbitration when other dispute resolution procedures have been exhausted.

Lawful Access Requests

The US CS entities may be required to disclose Personal Data in response to lawful access requests from public authorities, or to comply with national security or law enforcement requirements. Any such disclosure is made in accordance with our Public Authorities Access Request Policy, available at this link. 

Onward Transfers of Personal Data

The US CS entities remain responsible to you, as well as potentially liable to you under the conditions set forth in the Principles, for the processing of Personal Data received under the Data Privacy Framework and subsequently transferred to the third parties identified above.  

Subject to applicable data protection laws, you have multiple privacy rights in respect of the Personal Data we process about you:

• request confirmation that we are processing your Personal Data;

• request a copy of Personal Data we hold about you;

• request that we update Personal Data we hold about you or correct such data that is inaccurate or incomplete;

• restrict the way in which we use your Personal Data (e.g., if we have no legal right to keep using it) or limit our use of your Personal Data (e.g., if your Personal Data is inaccurate or unlawfully held);

• object to our processing of your Personal Data relating on grounds to your particular situation; 

• Object to our processing of your Personal Data for direct marketing purposes, at any time;

• withdraw the consent that you have given us to process your Personal Data (where we process your Personal Data on the basis of your consent);

• request that we delete the Personal Data we hold about you; and

• lodge a complaint with the relevant data protection authority regarding our processing of your Personal Data.

If you want to exercise one or more of the rights mentioned above, you can submit your request using our Data Subject Request Form here. Please note that as part of your data subject request, we may require additional information and documents, including Personal Data, in order to authenticate and validate your identity and to process your request. Such additional data will be then retained by us for legal purposes (e.g. as proof of the identity of the person submitting the request), in accordance with Section 4 above.

9. Children’s Privacy

Our Services are not designed to attract children under the age of 16. If we learn that a person under the age of 16 is using our Services, we will prohibit and attempt to block such use and will make reasonable efforts to promptly delete any Personal Data stored with us with regard to such child. If you believe that we might have any such data, please contact us via our Data Subject Request Portal here.