Business Services Privacy Policy

For the purposes of this document, Monetate refers to three corporate entities:

• Monetate, Inc
• Monetate SD Holdings, LLC
• SiteSpect, Inc.

Monetate is committed to meeting all of the EU GDPR requirements.

Monetate complies with the GDPR regarding the collection, use, and retention of personal information from European Union member countries, the United Kingdom, and Switzerland transferred to the United States. Monetate has certified that it adheres to the GDPR policies with respect to such data. If there is any conflict between the policies in this privacy policy and data subject rights under the GDPR policies, the GDPR policies shall govern.

Monetate complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Monetate has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Monetate has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

As part of the GDPR obligations, companies are required to advise you of their policy in a clear and transparent manner. They are required to provide this information free of charge. Listed below are a few (but not limited to) of the requirements:

• Who is responsible to control your personal data (if any), and their contact information
• The purpose of its collection
• Specifically, what is collected
• If it is shared with any third parties, and why
• Details of transfers to third countries and how it is protected during this transfer
• Your ability to “Opt Out” or withdraw consent at any time
• Your ability to access your personal data
• If the collection is part of a statutory or contractual obligation
• The existence of any automated decision making or profiling
• The source, if data is collected by a third party

Responsibility to Control Your Personal Data

Monetate has designated its Data Privacy Officer to oversee the control of personal data and coordinate Monetate’s compliance with the GDPR obligations. The contact information for the Data Privacy Officer appears near the end of this document.

Purpose of Collection

As noted in our general Privacy Policy, Monetate contracts with a variety of companies to provide a service to personalize, recommend and / or test variations in the digital customer experience on its client’s websites. Users of the websites are unlikely to be able to detect that Monetate is involved during the browsing experience.

In order to fulfill Monetate’s contractual obligation to its clients, it must collect some specific information. Monetate will not retain data longer than is necessary to fulfill the purposes for which it was collected or as required by applicable laws or regulations.

What is Collected

While Monetate believes that aggregated data it collects does not constitute personally identifiable information (PII) as defined by the GDPR, it secures this data as if the data is PII. The data is subject to strict access controls and when processed and transmitted by Monetate, the data is encrypted.

While providing services to our clients, Monetate collects the following data, which is stored in audit logs and available in reports accessible by clients of Monetate that could potentially raise privacy issues under GDPR:

• The user’s browser agent-string (also known as the User Agent)
• The user’s Ancillary Cookie Value (if configured by the client and consented to by the user on the client’s website)
• The user’s OmniChannel Cookie Value (if configured by the client and consented to by the user on the client’s website)
• The user’s IP address
• The user’s Monetate ID, an anonymous, randomized identifier stored as a cookie

Definitions of the above terms

The user’s browser agent-string is supplied by the user’s browser and it tells the website information about the browser and operating system. This allows the website to customize content for the capabilities of a particular device. On average, only one person in about 1,500 will have the same agent-string as you. On its own, that isn’t enough to reveal a person’s identity, but in combination with other details like geolocation to a particular ZIP code the agent-string might be used to identify an individual. Here is an example of an agent-string that was sent by a user using the FireFox browser, “Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0”.

The Ancillary Cookie Value and OmniChannel Cookie Value are simply “-” by default, which reveals nothing about the identity of the user. However, the website of the Monetate client can set these values, once it has obtained a user’s consent to use cookies.

An IP address is a numerical label which is used to identify one or more devices on the Internet. According to an EU court decision, an IP address is only personal information when it is accompanied by other data that when used together could reveal an individual’s identity.

Some Monetate products only display the first two octets of the IP address. By only providing a portion of the IP address to the clients, the clients ability to relate the IP address to a specific individual is limited, and location data will be limited to the state- or possibly county-level of detail.

The Monetate ID is an anonymous, randomized identifier that is generated for each user device and stored as a cookie. This is used to associate multiple visits to a website by the same user, to ensure consistency of the user experience. By setting this cookie value to “0” (numeric zero), an end user effectively opts-out of any further data collection by the Monetate business service.

Client Data Shared with Monetate

Monetate’s clients may electronically submit data or information to the Monetate Platform for hosting and processing purposes, in which case Monetate will process such information in accordance with the applicable Master Subscription Agreement, or as may be required by law. Monetate may access client data only for the purpose of providing the services or preventing or addressing service or technical problems, or as may be required by law.

Disclosure of Personal Data

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may also disclose your Personal Information to any regulatory or law enforcement agency if we believe that such action is necessary to protect the rights, property, or personal safety of Monetate, its customers, or any third party. In all other cases, Monetate does not share Personal Information with third parties. If that changes in the future, Monetate shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.