We at Monetate, Inc. (“Monetate,” “we,” “us,” or “our”) have created this privacy policy (this “Website Privacy Policy”) because we know that you care about how information you provide to us is used and shared. This Website Privacy Policy relates to Monetate’s information collection and use practices in connection with our website located at https://monetate.com (the “Website”).
Please note that our privacy practices governing our proprietary marketing optimization technology is governed by our Platform Privacy Policy located at https://www.monetate.com/platform-privacy-policy.
For the purposes of this document, Monetate refers to three corporate entities:
The Information We Collect
In the course of operating the Website, Monetate will collect the following types of information.
We collect information using “cookie” technology and JavaScript tags. Cookies are small packets of data that a website stores on your computer’s hard drive so that your computer will “remember” information about your visit. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them) to help us collect Other Information and to enhance your experience using the Website. If you do not want us to use cookies on your hard drive, you may use your browser’s preferences to turn that feature off on your computer. Please consult your Internet browser’s documentation for information on how to do this and how to delete persistent cookies. However, if you decide not to accept cookies from us, the Website may not function properly. We use JavaScript tags to trigger a sequence of events that includes viewing a first-party cookie (or setting that cookie if it does not already exist) and to help us tailor and optimize our Website and provide you relevant Monetate advertisements outside of our Website.
How We Use your Personal Data (purposes and legal basis)
Personal Data that we collect from your activity on our website is processed for the system administration (e.g. to improve the Website and services to you) and for statistical or security proposes of the Website as well as to solicit your feedback. The processing of this Personal Data for these purposes is based on our legitimate interests (Art. 6(1) lit. f GDPR).
Personal Data that you have provided in the Website’s contact forms is processed for the purposes specified in the consent declaration, e.g. for the purposes of direct marketing, to inform you about our products and services, and to provide you with our newsletter and invitations to upcoming events.
For the purposes of direct marketing, processing of some your Personal Data involves profiling-based decision-making. When you fill out a request form, sign up for a webinar or download any other products from our website (behavioral data) we score your activities as well as your respective demographic data (title, job role, function, industry, company and country and create a profile from this data by using automated decision-making (“lead scoring”). We use these profiles to automatically determine your level of interest in Monetate’s products and services. You receive points for your behavioral and demographic data. Once you have amassed a certain number of points, Monetate will call you to see if you would like to schedule a demo of Monetate’s products and services or to see if you would like more information on Monetate and its products and services. Thus, these profiling activities do not target you as an individual but in regard to your function as an employee of a company that may utilize our products and services. It therefore does not significantly affect you as a person and the profiling may be considered as within our legitimate interests according to Art. 6 (1) lit. f GDPR.
We also use and/or share your Personal Data as described below.
To the extent permitted by law, we may also disclose your Personal Data: (i) when required by law, court order, or other government or law enforcement authority or regulatory agency; or (ii) whenever we believe that disclosing such Personal Data is necessary or advisable, for example, to protect the rights, property, or safety of Monetate or others.
Your Rights in Respect to Your Personal Data
You have the right to access, remove, review, and/or make changes to the Personal Data processed by us by following the instructions found on the Website or by sending a request by e-mail to dpo@monetate.com. Furthermore, you have a right to restrict the processing of your Personal Data and a right to data portability which may be requested in the same way as described before.
We will process such requests no later than 25 days from receipt.
The foregoing rights are without prejudice to your right to launch a claim with your data protection authority, if applicable.
AS FAR AS WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR LEGITIMATE INTERESTS (ART. 6(1) LIT. F) GDPR), YOU MAY OBJECT TO PROCESSING (ART. 21(1) GDPR). WE PROCESS ON THE BASIS OF OUR LEGITIMATE INTERESTS WHERE THE PROCESSING IS NOT NECESSARY TO FULFIL A CONTRACT WITH YOU. YOU MAY FIND A DETAILED DESCRIPTION OF OUR PROCESSING ACTIVITIES AND THE LEGAL BASIS IN THE SECTION ABOVE (UNDER HOW WE USE THE PERSONAL DATA (PURPOSES AND LEGAL BASIS). IF YOU OBJECT TO SUCH PROCESSING, WE ASK YOU TO STATE THE GROUNDS OF YOU OBJECTION IN ORDER FOR US TO EXAMINE THE PROCESSING OF YOUR PERSONAL DATA AND DECIDE WHETHER TO ADJUST THE PROCESSING ACCORDINGLY.
FURTHERMORE, AS FAR AS YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSES OF DIRECT MARKETING (LEAD SCORING), YOU HAVE A RIGHT TO OBJECT TO ANY OF THIS DATA PROCESSING FREE OF CHARGE AT ANY TIME WITHOUT PROVIDING A REASON BY EMAILING DPO@MONETATE.COM (ART. 21(2) GDPR).
How Long We Store Your Personal Data
We maintain your Personal Data until you have requested that we stop processing it or for so long as needed in order to fulfil the purpose for which you provided your Personal Data, whichever comes first. Following either your request to cease processing or once this purpose is no longer relevant, we will permanently erase your Personal Data from our computer systems and cease all further processing of your Personal Data.
How We Protect your Personal Data
We take all necessary steps to protect your Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction as required by applicable law. We have appropriate technical and organizational measures to ensure a level of security appropriate to the risk of varying likelihood and severity for the rights and freedoms of you and other Users. We maintain these technical and organizational measures and may amend them from time to time to improve the overall security of our systems. Please understand, however, that no security system is impenetrable. We cannot guarantee the security of our databases, nor can we guarantee that your Personal Data will not be intercepted while being transmitted to and from us over the Internet. In particular, e-mail sent to or from the Website may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail.
Data Privacy Framework (DPF)
Monetate complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Monetate has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Monetate has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/
In the case of Monetate sharing Personal Information with a third party, Monetate shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.
In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), Monetate commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Monetate.
Monetate has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction
For Corporate Customers of Monetate Business Services
Monetate provides business services to many customers and serves in the capacity of a data processor under the Data Privacy Framework and the GDPR. To learn how Monetate handles data and options for enabling data protection features applicable to the GDPR, please review our Monetate Customer Notice on GDPR Support.
Forte Data Collection
Monetate provides the Forte application to allow clients to experiment and personalize their traffic.
While Monetate believes that aggregated data it collects does not constitute personally identifiable information (PII) as defined by the GDPR, it secures this data as if the data is PII. The data is subject to strict access controls and when processed and transmitted by Forte, the data is encrypted.
While providing services to our clients, Monetate collects the following data, which is stored in audit logs and available in reports accessible by clients of Forte that could potentially raise privacy issues under GDPR:
Definitions of the above terms
The user’s browser agent-string is supplied by the user’s browser and it tells the website information about the browser and operating system. This allows the website to customize content for the capabilities of a particular device. On average, only one person in about 1,500 will have the same agent-string as you. On its own, that isn’t enough to reveal a person’s identity, but in combination with other details like geolocation to a particular ZIP code the agent-string might be used to identify an individual. Here is an example of an agent-string that was sent by a user using the FireFox browser, “Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0”.
The Ancillary Cookie Value and OmniChannel Cookie Value are simply “-” by default, which reveals nothing about the identity of the user. However, the website of the Forte client can set these values, once it has obtained a user’s consent to use cookies.
An IP address is a numerical label which is used to identify one or more devices on the Internet. While Forte stores the entire IP address in its audit logs, when reported to SiteSpect clients only the first two octets of the IP address are displayed. By only providing a portion of the IP address to the clients, the clients ability to relate the IP address to a specific individual is limited, and location data will be limited to the state- or possibly county-level of detail. According to an EU court decision, an IP address is only personal information when it is accompanied by other data that when used together could reveal an individual’s identity.
The Forte ID is an anonymous, randomized identifier that is generated for each user device and stored as a cookie. Commonly the cookie is named “SSID” and set to persist within the user’s browser. This is used to associate multiple visits to a website by the same user, to ensure consistency of the user experience. By setting this cookie value to “0” (numeric zero), an end user effectively opts-out of any further data collection by the Forte business service.
Children
We do not knowingly collect Personal Data from children under the age of 13 through the Website. If you are under 13, please do not give us any Personal Data. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Website Privacy Policy by instructing their children never to provide Personal Data through the Website without parental permission. If you have reason to believe that a child under the age of 13 has provided Personal Data to us, please contact us, and we will endeavor to delete that information from our databases.
California Residents
Monetate does not monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser “Do Not Track” settings and/or signals.
External Websites
The Website may contain links to third-party websites. Monetate has no control over the privacy practices or the content of these websites. As such, we are not responsible for the content or the privacy policies of those third-party websites. You should check the applicable third-party privacy policy and terms of use when visiting any other websites.
Changes to This Website Privacy Policy
This Website Privacy Policy is effective as of the date stated at the top of this Website Privacy Policy. We may change this Website Privacy Policy from time to time. By accessing and/or using the Website after we make any such changes to this Website Privacy Policy, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, our use of your Personal Data is governed by the Website Privacy Policy in effect at the time we collect your Personal Data. Please refer back to this Website Privacy Policy on a regular basis.
How to Contact Us
If you have questions about this Website Privacy Policy, please contact Monetate via e-mail at dpo@monetate.com with “PRIVACY POLICY” in the subject line.
